Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2022, 13:23

General

  • Target

    d617cfaf2f5cfcb5c50ecc28d0d02582.exe

  • Size

    406KB

  • MD5

    d617cfaf2f5cfcb5c50ecc28d0d02582

  • SHA1

    63a2d370a2c0ef547cc7a78e220e0d9021e2b4a1

  • SHA256

    4a4d5455c9e941082c8c08a96102afc9d33abc40985bfcc00b6bee8c098066fd

  • SHA512

    857a130effc4aca8d5cebaaa78eace06242e7f96332553f5676f4670fdfdab45eed3306475d8e3a9ad7facf4e3b5cceac9aeb7e25c394a82324499e0b78fe8f0

Malware Config

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Loads dropped DLL 12 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe
    "C:\Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1388
    • \??\c:\users\admin\appdata\local\temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 
      c:\users\admin\appdata\local\temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1740
    • C:\Users\Admin\AppData\Local\icsys.icn.exe
      C:\Users\Admin\AppData\Local\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2032
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Modifies Installed Components in the registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:320
        • \??\c:\windows\system\spoolsv.exe
          c:\windows\system\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:852
          • \??\c:\windows\system\svchost.exe
            c:\windows\system\svchost.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Modifies Installed Components in the registry
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1416
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1116
            • C:\Windows\SysWOW64\at.exe
              at 15:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              6⤵
                PID:1792
              • C:\Windows\SysWOW64\at.exe
                at 15:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                  PID:1008
                • C:\Windows\SysWOW64\at.exe
                  at 15:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                  6⤵
                    PID:1572

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • C:\Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          7f9ebd4ed2db0d66c4be272c681bad48

          SHA1

          cefdff7b1cb786ff84458e6e16b1e2ead35f9c34

          SHA256

          d4fdf7e61db35ab2f6cbaaa4c02a9336b29d653e7249247a74c4f6fa787768b0

          SHA512

          627d9ae1a7cce0d4f3859034bd2224ea27ad1cd0d2d7592886e147ea7806de31d9bfd7a0aa4d955eb2854247b2029bd835e5b420d275f0616803efe3eec60997

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          274KB

          MD5

          0b3620dd44485b27ad873131d2f70d4c

          SHA1

          b855743f51c9e4c3da36ec9756c109238b989eb9

          SHA256

          bb61251c320f4d015720348527bd5c8afd7e1d72021023d23c886da7cff20c02

          SHA512

          52480505e8ce405dee2884e9c19de2baf723a59b8546d27374e148555beadfb589daa4d08d01ccfa676355866dbe774f04c2102c6223777a66f07f14c578a17e

        • C:\Windows\system\explorer.exe

          Filesize

          274KB

          MD5

          6ac0aa0db9190c2b036647e35286c4a3

          SHA1

          dd41819ff5b48c2963c2c22c4c5cb4d8d92f0738

          SHA256

          4cd24e9f7dbf5dc41474f1e2c712ca51ae060f984577c49a193f953eebcd90fd

          SHA512

          02f49bd5defe4cd340f78a6e35a0a72452e39cf5817edf2ddaa3f78d9f2a15bad875ddfa185198eba824350f525c001292fb687c301951fe330bd8a429cdf157

        • C:\Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          c4f5c608173d6253f80545588a3f5c6e

          SHA1

          07b044078cbf34b5082018c6a410dbf742e3e392

          SHA256

          21da2d60be3d93f293bf3fde6a25f676f10b7c8dbff356c25f7575b2a0df49a2

          SHA512

          a905edf9f82fd713e0cd3d7c5a84f071119e71848e12fc2693b2a731486f8ce6e5cd8b7a9b75aab82db8a11ce09892afa23e5deb4266cc213c7f9e09fb18b213

        • C:\Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          c4f5c608173d6253f80545588a3f5c6e

          SHA1

          07b044078cbf34b5082018c6a410dbf742e3e392

          SHA256

          21da2d60be3d93f293bf3fde6a25f676f10b7c8dbff356c25f7575b2a0df49a2

          SHA512

          a905edf9f82fd713e0cd3d7c5a84f071119e71848e12fc2693b2a731486f8ce6e5cd8b7a9b75aab82db8a11ce09892afa23e5deb4266cc213c7f9e09fb18b213

        • C:\Windows\system\svchost.exe

          Filesize

          274KB

          MD5

          83c07518f4e8111c8f53057592686954

          SHA1

          111678e76764d70fa271e7bce2933e48f287722d

          SHA256

          ab305ea1253a551e030a5fa5cc91be19a428b1c2f304df699476e1ac2dae0d5c

          SHA512

          914272e212b3978d49447ec3576b28cb27d1a3f407de5f2b59b90ff882e863ea21f9bbc64ec6440a822825f338afdddefbdfe0f15385601598c60aad48fe8867

        • \??\c:\users\admin\appdata\local\icsys.icn.exe

          Filesize

          274KB

          MD5

          7f9ebd4ed2db0d66c4be272c681bad48

          SHA1

          cefdff7b1cb786ff84458e6e16b1e2ead35f9c34

          SHA256

          d4fdf7e61db35ab2f6cbaaa4c02a9336b29d653e7249247a74c4f6fa787768b0

          SHA512

          627d9ae1a7cce0d4f3859034bd2224ea27ad1cd0d2d7592886e147ea7806de31d9bfd7a0aa4d955eb2854247b2029bd835e5b420d275f0616803efe3eec60997

        • \??\c:\windows\system\explorer.exe

          Filesize

          274KB

          MD5

          6ac0aa0db9190c2b036647e35286c4a3

          SHA1

          dd41819ff5b48c2963c2c22c4c5cb4d8d92f0738

          SHA256

          4cd24e9f7dbf5dc41474f1e2c712ca51ae060f984577c49a193f953eebcd90fd

          SHA512

          02f49bd5defe4cd340f78a6e35a0a72452e39cf5817edf2ddaa3f78d9f2a15bad875ddfa185198eba824350f525c001292fb687c301951fe330bd8a429cdf157

        • \??\c:\windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          c4f5c608173d6253f80545588a3f5c6e

          SHA1

          07b044078cbf34b5082018c6a410dbf742e3e392

          SHA256

          21da2d60be3d93f293bf3fde6a25f676f10b7c8dbff356c25f7575b2a0df49a2

          SHA512

          a905edf9f82fd713e0cd3d7c5a84f071119e71848e12fc2693b2a731486f8ce6e5cd8b7a9b75aab82db8a11ce09892afa23e5deb4266cc213c7f9e09fb18b213

        • \??\c:\windows\system\svchost.exe

          Filesize

          274KB

          MD5

          83c07518f4e8111c8f53057592686954

          SHA1

          111678e76764d70fa271e7bce2933e48f287722d

          SHA256

          ab305ea1253a551e030a5fa5cc91be19a428b1c2f304df699476e1ac2dae0d5c

          SHA512

          914272e212b3978d49447ec3576b28cb27d1a3f407de5f2b59b90ff882e863ea21f9bbc64ec6440a822825f338afdddefbdfe0f15385601598c60aad48fe8867

        • \Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • \Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • \Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          7f9ebd4ed2db0d66c4be272c681bad48

          SHA1

          cefdff7b1cb786ff84458e6e16b1e2ead35f9c34

          SHA256

          d4fdf7e61db35ab2f6cbaaa4c02a9336b29d653e7249247a74c4f6fa787768b0

          SHA512

          627d9ae1a7cce0d4f3859034bd2224ea27ad1cd0d2d7592886e147ea7806de31d9bfd7a0aa4d955eb2854247b2029bd835e5b420d275f0616803efe3eec60997

        • \Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          7f9ebd4ed2db0d66c4be272c681bad48

          SHA1

          cefdff7b1cb786ff84458e6e16b1e2ead35f9c34

          SHA256

          d4fdf7e61db35ab2f6cbaaa4c02a9336b29d653e7249247a74c4f6fa787768b0

          SHA512

          627d9ae1a7cce0d4f3859034bd2224ea27ad1cd0d2d7592886e147ea7806de31d9bfd7a0aa4d955eb2854247b2029bd835e5b420d275f0616803efe3eec60997

        • \Windows\system\explorer.exe

          Filesize

          274KB

          MD5

          6ac0aa0db9190c2b036647e35286c4a3

          SHA1

          dd41819ff5b48c2963c2c22c4c5cb4d8d92f0738

          SHA256

          4cd24e9f7dbf5dc41474f1e2c712ca51ae060f984577c49a193f953eebcd90fd

          SHA512

          02f49bd5defe4cd340f78a6e35a0a72452e39cf5817edf2ddaa3f78d9f2a15bad875ddfa185198eba824350f525c001292fb687c301951fe330bd8a429cdf157

        • \Windows\system\explorer.exe

          Filesize

          274KB

          MD5

          6ac0aa0db9190c2b036647e35286c4a3

          SHA1

          dd41819ff5b48c2963c2c22c4c5cb4d8d92f0738

          SHA256

          4cd24e9f7dbf5dc41474f1e2c712ca51ae060f984577c49a193f953eebcd90fd

          SHA512

          02f49bd5defe4cd340f78a6e35a0a72452e39cf5817edf2ddaa3f78d9f2a15bad875ddfa185198eba824350f525c001292fb687c301951fe330bd8a429cdf157

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          c4f5c608173d6253f80545588a3f5c6e

          SHA1

          07b044078cbf34b5082018c6a410dbf742e3e392

          SHA256

          21da2d60be3d93f293bf3fde6a25f676f10b7c8dbff356c25f7575b2a0df49a2

          SHA512

          a905edf9f82fd713e0cd3d7c5a84f071119e71848e12fc2693b2a731486f8ce6e5cd8b7a9b75aab82db8a11ce09892afa23e5deb4266cc213c7f9e09fb18b213

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          c4f5c608173d6253f80545588a3f5c6e

          SHA1

          07b044078cbf34b5082018c6a410dbf742e3e392

          SHA256

          21da2d60be3d93f293bf3fde6a25f676f10b7c8dbff356c25f7575b2a0df49a2

          SHA512

          a905edf9f82fd713e0cd3d7c5a84f071119e71848e12fc2693b2a731486f8ce6e5cd8b7a9b75aab82db8a11ce09892afa23e5deb4266cc213c7f9e09fb18b213

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          c4f5c608173d6253f80545588a3f5c6e

          SHA1

          07b044078cbf34b5082018c6a410dbf742e3e392

          SHA256

          21da2d60be3d93f293bf3fde6a25f676f10b7c8dbff356c25f7575b2a0df49a2

          SHA512

          a905edf9f82fd713e0cd3d7c5a84f071119e71848e12fc2693b2a731486f8ce6e5cd8b7a9b75aab82db8a11ce09892afa23e5deb4266cc213c7f9e09fb18b213

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          c4f5c608173d6253f80545588a3f5c6e

          SHA1

          07b044078cbf34b5082018c6a410dbf742e3e392

          SHA256

          21da2d60be3d93f293bf3fde6a25f676f10b7c8dbff356c25f7575b2a0df49a2

          SHA512

          a905edf9f82fd713e0cd3d7c5a84f071119e71848e12fc2693b2a731486f8ce6e5cd8b7a9b75aab82db8a11ce09892afa23e5deb4266cc213c7f9e09fb18b213

        • \Windows\system\svchost.exe

          Filesize

          274KB

          MD5

          83c07518f4e8111c8f53057592686954

          SHA1

          111678e76764d70fa271e7bce2933e48f287722d

          SHA256

          ab305ea1253a551e030a5fa5cc91be19a428b1c2f304df699476e1ac2dae0d5c

          SHA512

          914272e212b3978d49447ec3576b28cb27d1a3f407de5f2b59b90ff882e863ea21f9bbc64ec6440a822825f338afdddefbdfe0f15385601598c60aad48fe8867

        • \Windows\system\svchost.exe

          Filesize

          274KB

          MD5

          83c07518f4e8111c8f53057592686954

          SHA1

          111678e76764d70fa271e7bce2933e48f287722d

          SHA256

          ab305ea1253a551e030a5fa5cc91be19a428b1c2f304df699476e1ac2dae0d5c

          SHA512

          914272e212b3978d49447ec3576b28cb27d1a3f407de5f2b59b90ff882e863ea21f9bbc64ec6440a822825f338afdddefbdfe0f15385601598c60aad48fe8867

        • memory/320-110-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/320-134-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/852-123-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/852-111-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1116-122-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1388-125-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1388-104-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1388-57-0x00000000753C1000-0x00000000753C3000-memory.dmp

          Filesize

          8KB

        • memory/1388-105-0x0000000002440000-0x000000000247E000-memory.dmp

          Filesize

          248KB

        • memory/1416-129-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1740-70-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB

        • memory/1740-73-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB

        • memory/1740-65-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB

        • memory/1740-67-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB

        • memory/2032-107-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2032-124-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB