Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
64s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe
Resource
win10v2004-20220901-en
General
-
Target
3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe
-
Size
405KB
-
MD5
b76b66e61a86b4708d164f16a587b7eb
-
SHA1
002d8fc45341c61238d00136059aa64eaef44d22
-
SHA256
3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20
-
SHA512
bc47f19345908ad06679e4bf729eb623b15173079a0f828f62de2be1c5ae6ab21cde0633baf93db237e6e91085e508f29c3acddd7fbfc2fe7b8d333adccfc9ff
-
SSDEEP
6144:2UwHuNnp2M8TJCJkI/Y8PJw1nQ5orsV7qsmgFB/pAeEURLHcc04TU:rt2M8Tln3wYsmgFh8UFK1
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 6 IoCs
resource yara_rule behavioral1/memory/920-59-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/920-61-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/920-62-0x0000000000401180-mapping.dmp family_isrstealer behavioral1/memory/920-70-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/920-78-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/920-79-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/932-76-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/932-77-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/932-80-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 3 IoCs
resource yara_rule behavioral1/memory/932-76-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/932-77-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/932-80-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
resource yara_rule behavioral1/memory/932-71-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/932-75-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/932-76-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/932-77-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/932-80-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts RegSvcs.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 564 set thread context of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 920 set thread context of 1704 920 RegSvcs.exe 31 PID 920 set thread context of 932 920 RegSvcs.exe 32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 920 RegSvcs.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 564 wrote to memory of 924 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 29 PID 564 wrote to memory of 924 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 29 PID 564 wrote to memory of 924 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 29 PID 564 wrote to memory of 924 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 29 PID 564 wrote to memory of 924 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 29 PID 564 wrote to memory of 924 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 29 PID 564 wrote to memory of 924 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 29 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 564 wrote to memory of 920 564 3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe 30 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 1704 920 RegSvcs.exe 31 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32 PID 920 wrote to memory of 932 920 RegSvcs.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe"C:\Users\Admin\AppData\Local\Temp\3ad42d527ed36160a80d57c9619b3b0f55fd20cc23c08637f732846cd8aa0c20.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵PID:924
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe/scomma "C:\Users\Admin\AppData\Local\Temp\kmKAtsgLo4.ini"3⤵PID:1704
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe/scomma "C:\Users\Admin\AppData\Local\Temp\8soRWkNX7a.ini"3⤵
- Accesses Microsoft Outlook accounts
PID:932
-
-