Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2022, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
Revised shipment.pdf.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Revised shipment.pdf.exe
Resource
win10v2004-20220721-en
General
-
Target
Revised shipment.pdf.exe
-
Size
706KB
-
MD5
f79203454fd766c8189d00c43cfc7485
-
SHA1
fe44898d206f0b4ef9497e7b7b2e9dedcd4335aa
-
SHA256
3909f1e1d41d36e0f62bd770841a0a8ea28c2b7d52f2e2fc77457538fbd7a291
-
SHA512
2b88a745ec24591e5a5b28ade1470416a6bfe2bed86383c276736d0142ddae64bf985cd84772ac00512868f1741f3a7cab555a7a53f95eb5408a582d0fbb8ad1
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/3432-153-0x00000000003A0000-0x00000000003BA000-memory.dmp family_stormkitty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation Revised shipment.pdf.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 55 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4532 set thread context of 1428 4532 Revised shipment.pdf.exe 100 PID 1428 set thread context of 3432 1428 Revised shipment.pdf.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4224 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 4532 Revised shipment.pdf.exe 3588 powershell.exe 3588 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4532 Revised shipment.pdf.exe Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 3432 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1428 Revised shipment.pdf.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3588 4532 Revised shipment.pdf.exe 95 PID 4532 wrote to memory of 3588 4532 Revised shipment.pdf.exe 95 PID 4532 wrote to memory of 3588 4532 Revised shipment.pdf.exe 95 PID 4532 wrote to memory of 4224 4532 Revised shipment.pdf.exe 97 PID 4532 wrote to memory of 4224 4532 Revised shipment.pdf.exe 97 PID 4532 wrote to memory of 4224 4532 Revised shipment.pdf.exe 97 PID 4532 wrote to memory of 1652 4532 Revised shipment.pdf.exe 99 PID 4532 wrote to memory of 1652 4532 Revised shipment.pdf.exe 99 PID 4532 wrote to memory of 1652 4532 Revised shipment.pdf.exe 99 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 4532 wrote to memory of 1428 4532 Revised shipment.pdf.exe 100 PID 1428 wrote to memory of 3432 1428 Revised shipment.pdf.exe 101 PID 1428 wrote to memory of 3432 1428 Revised shipment.pdf.exe 101 PID 1428 wrote to memory of 3432 1428 Revised shipment.pdf.exe 101 PID 1428 wrote to memory of 3432 1428 Revised shipment.pdf.exe 101 PID 1428 wrote to memory of 3432 1428 Revised shipment.pdf.exe 101 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vEOwgfttl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vEOwgfttl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E8D.tmp"2⤵
- Creates scheduled task(s)
PID:4224
-
-
C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"2⤵PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Revised shipment.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3432
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5762d8995da6581720c7198ce4ebd758e
SHA1055f5d434d593ace29eb05d6dd7b9ca96c715603
SHA256e97ced990cc461440c7fa8574c5122183a2cc86e9628240bfce4fadc547e5d83
SHA51283a38f477f9b857bc032da016b47f139dece11e0420fada50fccc80cae07331728d6a06f8c4037ac376ad57ac1b098c52ecd407e5c2701a217a15e8f4a03d8fd