Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 05:47

General

  • Target

    771fb47f72480a0a1e93dab12165e657.exe

  • Size

    836KB

  • MD5

    771fb47f72480a0a1e93dab12165e657

  • SHA1

    aee13ab0f1703ec1a340c8187eb0e528f5c09ac7

  • SHA256

    020023df02a173b4f891fa2f6c2f7a5d4145faf4c5c94eadbc346d5bbb593568

  • SHA512

    fbba7ea422a6fd0ec2c369e9946bef136aee77e18d630084101ce22e861449a6bacedcc177b99c4c84326a8e20f2c53df59cd0d6c47735a73b10d5823275db01

  • SSDEEP

    12288:B7Kr7YP0da95eFAKBuoZmPIF43v+4Z0lR/y7Poco:cYMdaiqGmPIFW3Z0lR/Oo

Malware Config

Extracted

Family

snakekeylogger

Credentials
C2

https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\771fb47f72480a0a1e93dab12165e657.exe
    "C:\Users\Admin\AppData\Local\Temp\771fb47f72480a0a1e93dab12165e657.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\771fb47f72480a0a1e93dab12165e657.exe
      "C:\Users\Admin\AppData\Local\Temp\771fb47f72480a0a1e93dab12165e657.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/628-65-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/628-66-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/628-71-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/628-61-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/628-60-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/628-63-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/628-69-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1980-55-0x0000000076031000-0x0000000076033000-memory.dmp

    Filesize

    8KB

  • memory/1980-54-0x0000000001360000-0x0000000001434000-memory.dmp

    Filesize

    848KB

  • memory/1980-59-0x0000000000E00000-0x0000000000E26000-memory.dmp

    Filesize

    152KB

  • memory/1980-58-0x0000000005B90000-0x0000000005C10000-memory.dmp

    Filesize

    512KB

  • memory/1980-57-0x0000000000930000-0x000000000093C000-memory.dmp

    Filesize

    48KB

  • memory/1980-56-0x0000000000680000-0x000000000069A000-memory.dmp

    Filesize

    104KB