Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
09/08/2022, 18:28
Behavioral task
behavioral1
Sample
f7e5a5c100fcf5a248dfe0424bc5bbdc.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
f7e5a5c100fcf5a248dfe0424bc5bbdc.exe
Resource
win10v2004-20220721-en
General
-
Target
f7e5a5c100fcf5a248dfe0424bc5bbdc.exe
-
Size
132KB
-
MD5
f7e5a5c100fcf5a248dfe0424bc5bbdc
-
SHA1
05fab29b3f901ea56ebc0d5e240aa747aa44ee4f
-
SHA256
fafa8057f024c7a3c30e48b63d05d712e7de1f2f38f592a03cabbe8917942a89
-
SHA512
048b661425a63033980b1253bd0e8e24de0eb6ea230e24c46eec965371cd74f7ebd27ae004f6ee006abb48879fa3258ff6d4d049380ea8da57cda5953fb91bf2
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 4 IoCs
resource yara_rule behavioral1/memory/996-60-0x00000000000A4F6E-mapping.dmp family_stormkitty behavioral1/memory/996-59-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/996-62-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty behavioral1/memory/996-64-0x0000000000090000-0x00000000000AA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 icanhazip.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1920 set thread context of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 996 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 PID 1920 wrote to memory of 996 1920 f7e5a5c100fcf5a248dfe0424bc5bbdc.exe 27 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7e5a5c100fcf5a248dfe0424bc5bbdc.exe"C:\Users\Admin\AppData\Local\Temp\f7e5a5c100fcf5a248dfe0424bc5bbdc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:996
-