Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    64s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 14:54 UTC

General

  • Target

    161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6.exe

  • Size

    404KB

  • MD5

    4e41e8f87c89c2f7dd423a0750871b81

  • SHA1

    fc85caa8b48841fbd8064fc7bbe3a1d13b2c8992

  • SHA256

    161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6

  • SHA512

    1eaf21197de113e55c2bdf2db6522245a2381d0696f9caa4f6c26e9443cdfe38f78c4d8a04e0b0baae58c1ee7a406fdf1336bfad4a921e1d6da2c09913f790ed

  • SSDEEP

    12288:/B/USBseMoZWv6TuKHM+mm7Q2aQfRE6QMm:/BUJepkyTrHM+mEjaQftQ3

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 4 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • Nirsoft 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6.exe
    "C:\Users\Admin\AppData\Local\Temp\161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6.exe
      "C:\Users\Admin\AppData\Local\Temp\161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Users\Admin\AppData\Local\Temp\161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6.exe
        /scomma "C:\Users\Admin\AppData\Local\Temp\8IgF5wRIO1.ini"
        3⤵
          PID:1560
        • C:\Users\Admin\AppData\Local\Temp\161d4de39ca95ff50682c36624d03beca497957619f7b69b5ecae8b045cf22f6.exe
          /scomma "C:\Users\Admin\AppData\Local\Temp\DeUYmF4p5D.ini"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:532

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/532-85-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/532-83-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/532-82-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/532-78-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1248-54-0x0000000075351000-0x0000000075353000-memory.dmp

      Filesize

      8KB

    • memory/1248-55-0x00000000747F0000-0x0000000074D9B000-memory.dmp

      Filesize

      5.7MB

    • memory/1248-56-0x00000000747F0000-0x0000000074D9B000-memory.dmp

      Filesize

      5.7MB

    • memory/1248-57-0x0000000000C25000-0x0000000000C36000-memory.dmp

      Filesize

      68KB

    • memory/1248-67-0x00000000747F0000-0x0000000074D9B000-memory.dmp

      Filesize

      5.7MB

    • memory/1248-68-0x0000000000C25000-0x0000000000C36000-memory.dmp

      Filesize

      68KB

    • memory/1560-77-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1560-71-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1560-75-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1560-76-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1560-84-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1988-63-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1988-61-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1988-59-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1988-58-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1988-86-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.