Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
207s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24/11/2022, 03:23
General
-
Target
239dcacbfdabe7bf250d1ab803789144b93601f8849f12d75dbf8716db407ef3.exe
-
Size
351KB
-
MD5
f70ab20d0b560fd0e6d378105718491a
-
SHA1
c689a07f5b05a94edeee2832e63dd7e2f0f2024d
-
SHA256
239dcacbfdabe7bf250d1ab803789144b93601f8849f12d75dbf8716db407ef3
-
SHA512
4cd2cc662f0529c1ee4c8021c5eb786b80e86be71358f340907aa0a8a05329a8cae42ee2f42e5138154f470e5d776c96a84035139fc1ab4fa2ae6f5842a475a5
-
SSDEEP
6144:oAAYDXa1DdFIHmGm7vx3Dp486h5LH3jnLd9crJ2E1aWWySm+5B5:7DXCDdFIHY93DG8WznB8J2iadB
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 6 IoCs
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
-
Nirsoft 4 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\239dcacbfdabe7bf250d1ab803789144b93601f8849f12d75dbf8716db407ef3.exe"C:\Users\Admin\AppData\Local\Temp\239dcacbfdabe7bf250d1ab803789144b93601f8849f12d75dbf8716db407ef3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\EtDps00DdD.ini"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\olNA29L2Jw.ini"3⤵
- Accesses Microsoft Outlook accounts
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\DuJ8F5CVIe.ini"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\rWQsIFQflS.ini"5⤵
- Accesses Microsoft Outlook accounts
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
Filesize
10KB
MD5b3bbb175906ed2831daef23eccea6a2c
SHA1ed5cb8c8f225ead014298ae5636c142cfed448dd
SHA256be649d0f7996abd93f2a4f05d71cf65ab688f9007017c6791cd94033133947eb
SHA512185a3c6f62dd68f3d9c2b9d49079363bf3c8cbbcbbd89a8416060af2f47c28e72055bad653d7d1832326eccde38169fd826fcc2a4867ae61483d56893d9bd986
-
Filesize
10KB
MD5b3bbb175906ed2831daef23eccea6a2c
SHA1ed5cb8c8f225ead014298ae5636c142cfed448dd
SHA256be649d0f7996abd93f2a4f05d71cf65ab688f9007017c6791cd94033133947eb
SHA512185a3c6f62dd68f3d9c2b9d49079363bf3c8cbbcbbd89a8416060af2f47c28e72055bad653d7d1832326eccde38169fd826fcc2a4867ae61483d56893d9bd986
-
Filesize
351KB
MD5f70ab20d0b560fd0e6d378105718491a
SHA1c689a07f5b05a94edeee2832e63dd7e2f0f2024d
SHA256239dcacbfdabe7bf250d1ab803789144b93601f8849f12d75dbf8716db407ef3
SHA5124cd2cc662f0529c1ee4c8021c5eb786b80e86be71358f340907aa0a8a05329a8cae42ee2f42e5138154f470e5d776c96a84035139fc1ab4fa2ae6f5842a475a5
-
Filesize
351KB
MD5f70ab20d0b560fd0e6d378105718491a
SHA1c689a07f5b05a94edeee2832e63dd7e2f0f2024d
SHA256239dcacbfdabe7bf250d1ab803789144b93601f8849f12d75dbf8716db407ef3
SHA5124cd2cc662f0529c1ee4c8021c5eb786b80e86be71358f340907aa0a8a05329a8cae42ee2f42e5138154f470e5d776c96a84035139fc1ab4fa2ae6f5842a475a5
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
5.7MB
-
Filesize
5.7MB