Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
05/08/2022, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
Revised shipment.pdf.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Revised shipment.pdf.exe
Resource
win10v2004-20220721-en
General
-
Target
Revised shipment.pdf.exe
-
Size
706KB
-
MD5
f79203454fd766c8189d00c43cfc7485
-
SHA1
fe44898d206f0b4ef9497e7b7b2e9dedcd4335aa
-
SHA256
3909f1e1d41d36e0f62bd770841a0a8ea28c2b7d52f2e2fc77457538fbd7a291
-
SHA512
2b88a745ec24591e5a5b28ade1470416a6bfe2bed86383c276736d0142ddae64bf985cd84772ac00512868f1741f3a7cab555a7a53f95eb5408a582d0fbb8ad1
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
resource yara_rule behavioral1/memory/1392-80-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/1392-81-0x00000000000A4F6E-mapping.dmp family_stormkitty behavioral1/memory/1392-85-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/1392-83-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1924 set thread context of 456 1924 Revised shipment.pdf.exe 31 PID 456 set thread context of 1392 456 Revised shipment.pdf.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1360 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1924 Revised shipment.pdf.exe 1924 Revised shipment.pdf.exe 1924 Revised shipment.pdf.exe 1924 Revised shipment.pdf.exe 1924 Revised shipment.pdf.exe 1924 Revised shipment.pdf.exe 1384 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1924 Revised shipment.pdf.exe Token: SeDebugPrivilege 1384 powershell.exe Token: SeDebugPrivilege 1392 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 456 Revised shipment.pdf.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1384 1924 Revised shipment.pdf.exe 27 PID 1924 wrote to memory of 1384 1924 Revised shipment.pdf.exe 27 PID 1924 wrote to memory of 1384 1924 Revised shipment.pdf.exe 27 PID 1924 wrote to memory of 1384 1924 Revised shipment.pdf.exe 27 PID 1924 wrote to memory of 1360 1924 Revised shipment.pdf.exe 29 PID 1924 wrote to memory of 1360 1924 Revised shipment.pdf.exe 29 PID 1924 wrote to memory of 1360 1924 Revised shipment.pdf.exe 29 PID 1924 wrote to memory of 1360 1924 Revised shipment.pdf.exe 29 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 1924 wrote to memory of 456 1924 Revised shipment.pdf.exe 31 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 PID 456 wrote to memory of 1392 456 Revised shipment.pdf.exe 32 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vEOwgfttl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vEOwgfttl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA60.tmp"2⤵
- Creates scheduled task(s)
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1392
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d2845cc258e0426e595acc15fe5bde0f
SHA196e4a0bbd2f79b25221fb36e8159137db554685b
SHA256c85f1b660575010bc5287d71e11dcd10ba961eea989e4529bf3e420b149a2752
SHA51289a8d4db808edbeede719c2053825971a851d7cffcb7c187202e2cd7897785c2b427aec8a2f2e728c112895752cea1a4bd8c591f6aebed7390d8f24572fb2d63