Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2022, 13:23

General

  • Target

    d617cfaf2f5cfcb5c50ecc28d0d02582.exe

  • Size

    406KB

  • MD5

    d617cfaf2f5cfcb5c50ecc28d0d02582

  • SHA1

    63a2d370a2c0ef547cc7a78e220e0d9021e2b4a1

  • SHA256

    4a4d5455c9e941082c8c08a96102afc9d33abc40985bfcc00b6bee8c098066fd

  • SHA512

    857a130effc4aca8d5cebaaa78eace06242e7f96332553f5676f4670fdfdab45eed3306475d8e3a9ad7facf4e3b5cceac9aeb7e25c394a82324499e0b78fe8f0

Malware Config

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe
    "C:\Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5044
    • \??\c:\users\admin\appdata\local\temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 
      c:\users\admin\appdata\local\temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2596
    • C:\Users\Admin\AppData\Local\icsys.icn.exe
      C:\Users\Admin\AppData\Local\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4840
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:32
        • \??\c:\windows\system\spoolsv.exe
          c:\windows\system\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4140
          • \??\c:\windows\system\svchost.exe
            c:\windows\system\svchost.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Modifies Installed Components in the registry
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4040
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4652
            • C:\Windows\SysWOW64\at.exe
              at 13:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              6⤵
                PID:2272
              • C:\Windows\SysWOW64\at.exe
                at 13:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                  PID:2016
                • C:\Windows\SysWOW64\at.exe
                  at 13:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                  6⤵
                    PID:4324

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • C:\Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          7f9ebd4ed2db0d66c4be272c681bad48

          SHA1

          cefdff7b1cb786ff84458e6e16b1e2ead35f9c34

          SHA256

          d4fdf7e61db35ab2f6cbaaa4c02a9336b29d653e7249247a74c4f6fa787768b0

          SHA512

          627d9ae1a7cce0d4f3859034bd2224ea27ad1cd0d2d7592886e147ea7806de31d9bfd7a0aa4d955eb2854247b2029bd835e5b420d275f0616803efe3eec60997

        • C:\Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          7f9ebd4ed2db0d66c4be272c681bad48

          SHA1

          cefdff7b1cb786ff84458e6e16b1e2ead35f9c34

          SHA256

          d4fdf7e61db35ab2f6cbaaa4c02a9336b29d653e7249247a74c4f6fa787768b0

          SHA512

          627d9ae1a7cce0d4f3859034bd2224ea27ad1cd0d2d7592886e147ea7806de31d9bfd7a0aa4d955eb2854247b2029bd835e5b420d275f0616803efe3eec60997

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          274KB

          MD5

          b52b4c1f903702ac8827b54b5895b85e

          SHA1

          f651b831e085031fbc3879947c6207ae1986945b

          SHA256

          b23f99a60ecaa8552a374ee7703fce697bb411fb5db606c9701ead842564c9c5

          SHA512

          49c029ef40edcb61c9347acefbfd8e19c19ef4dbf286d89b419df480b18aeba2039a7d46b5aa7c45cba5b6cff304204a4ff5b1634559566510eb0cd77ce29dd7

        • C:\Windows\System\explorer.exe

          Filesize

          274KB

          MD5

          6e70ec78f2ea0344436dc44ea90b8184

          SHA1

          aa0a52d19268b5f241b7e6f286fd24575bd571b6

          SHA256

          1d1a8f48382eb2e5dc2a5fb17e01a1de7c9a3ba7e74dfd7e13b1d1f093262200

          SHA512

          d6c4deb867dd55611e5918766701d09c02c127dc9ea97523e4a60f17f7f44a461b1feb2cf5a33edfbd7059aaa4f261ab9970647d352b2bff22cf5dbfeb867044

        • C:\Windows\System\spoolsv.exe

          Filesize

          274KB

          MD5

          994d669de9b537c4b35af599c830965a

          SHA1

          a55bbff445ab2066720e1a2d2addc6ba3a96b27c

          SHA256

          c57f7888ee4b8d7d1c8ab60f71e77762d546a484d7824c11104ec1250e54a638

          SHA512

          d847ae90892377572aa046b65ee7dfaff7a37181088235b16a7f8b2b940e88480dd4857c327ea09485de4d068bc3ed7cc815e479ea2981d351055f0839e833b7

        • C:\Windows\System\spoolsv.exe

          Filesize

          274KB

          MD5

          994d669de9b537c4b35af599c830965a

          SHA1

          a55bbff445ab2066720e1a2d2addc6ba3a96b27c

          SHA256

          c57f7888ee4b8d7d1c8ab60f71e77762d546a484d7824c11104ec1250e54a638

          SHA512

          d847ae90892377572aa046b65ee7dfaff7a37181088235b16a7f8b2b940e88480dd4857c327ea09485de4d068bc3ed7cc815e479ea2981d351055f0839e833b7

        • C:\Windows\System\svchost.exe

          Filesize

          274KB

          MD5

          f25dbd987cff7aec20dd641bf1c2b5d8

          SHA1

          64abc14e4362f6b97fe3057c45e61ad913a4be52

          SHA256

          71f4b0adc1a5dc5cdb3086364cf9abc6c4a9a13a53721df64027ff6cd5f1c276

          SHA512

          60e467cdd62bef5f26baf85a4c8352adb3eae902636fce74dd79a2c693e67643138fd8ffe6f33e5c45032662d96428cbca39cd749eb5f35911833b8a5d82f483

        • \??\c:\users\admin\appdata\local\temp\d617cfaf2f5cfcb5c50ecc28d0d02582.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • \??\c:\windows\system\explorer.exe

          Filesize

          274KB

          MD5

          6e70ec78f2ea0344436dc44ea90b8184

          SHA1

          aa0a52d19268b5f241b7e6f286fd24575bd571b6

          SHA256

          1d1a8f48382eb2e5dc2a5fb17e01a1de7c9a3ba7e74dfd7e13b1d1f093262200

          SHA512

          d6c4deb867dd55611e5918766701d09c02c127dc9ea97523e4a60f17f7f44a461b1feb2cf5a33edfbd7059aaa4f261ab9970647d352b2bff22cf5dbfeb867044

        • \??\c:\windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          994d669de9b537c4b35af599c830965a

          SHA1

          a55bbff445ab2066720e1a2d2addc6ba3a96b27c

          SHA256

          c57f7888ee4b8d7d1c8ab60f71e77762d546a484d7824c11104ec1250e54a638

          SHA512

          d847ae90892377572aa046b65ee7dfaff7a37181088235b16a7f8b2b940e88480dd4857c327ea09485de4d068bc3ed7cc815e479ea2981d351055f0839e833b7

        • \??\c:\windows\system\svchost.exe

          Filesize

          274KB

          MD5

          f25dbd987cff7aec20dd641bf1c2b5d8

          SHA1

          64abc14e4362f6b97fe3057c45e61ad913a4be52

          SHA256

          71f4b0adc1a5dc5cdb3086364cf9abc6c4a9a13a53721df64027ff6cd5f1c276

          SHA512

          60e467cdd62bef5f26baf85a4c8352adb3eae902636fce74dd79a2c693e67643138fd8ffe6f33e5c45032662d96428cbca39cd749eb5f35911833b8a5d82f483

        • memory/32-164-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/32-185-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2596-142-0x0000000000570000-0x000000000058A000-memory.dmp

          Filesize

          104KB

        • memory/2596-157-0x0000000004D40000-0x0000000004DA6000-memory.dmp

          Filesize

          408KB

        • memory/2596-183-0x00000000057B0000-0x000000000584C000-memory.dmp

          Filesize

          624KB

        • memory/4040-182-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/4140-177-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/4140-168-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/4652-176-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/4840-178-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/4840-162-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/5044-179-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/5044-140-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB