Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
249s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 17:38
Behavioral task
behavioral1
Sample
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe
Resource
win10v2004-20220812-en
General
-
Target
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe
-
Size
1012KB
-
MD5
98d0000c28ed30d94374762113976b75
-
SHA1
60ceb509382e6309855d32cfcc99b34d782bd083
-
SHA256
92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f
-
SHA512
c1f3586a7b79c74de0b3ea7eb6d13c925d98655491ce043a9db56feef80c9b40e29f86b9e8d3e94328fc6c51722dc91e4e93b37beb15be97a4bbe8842f7ff1fa
-
SSDEEP
24576:2vzgO5yKsUaSuErRWNoEb0RkxFdtBNN57:zO5jGErsNrcc75
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 5 IoCs
resource yara_rule behavioral1/memory/1832-60-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1832-63-0x0000000000401180-mapping.dmp family_isrstealer behavioral1/memory/1832-62-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1832-74-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1832-84-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/316-81-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/316-83-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 2 IoCs
resource yara_rule behavioral1/memory/316-81-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/316-83-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
resource yara_rule behavioral1/memory/972-68-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/972-72-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/972-73-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/972-75-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/316-76-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/316-80-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/316-81-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/972-82-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/316-83-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 772 set thread context of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 1832 set thread context of 972 1832 vbc.exe 28 PID 1832 set thread context of 316 1832 vbc.exe 29 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1832 vbc.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 772 wrote to memory of 1832 772 92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe 27 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 972 1832 vbc.exe 28 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29 PID 1832 wrote to memory of 316 1832 vbc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe"C:\Users\Admin\AppData\Local\Temp\92810bfa22f1d71451860ab5ca81931a9e77218e89020e207438e19aa387840f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\aOxoKSB9Uh.ini"3⤵PID:972
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\M07X7D7qcs.ini"3⤵
- Accesses Microsoft Outlook accounts
PID:316
-
-