Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe
Resource
win10v2004-20220901-en
General
-
Target
9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe
-
Size
411KB
-
MD5
05de72909298f6ce51e8c0207db5a6c1
-
SHA1
7a52632ad804a1a3cd8251f2c0a6517207dbde6e
-
SHA256
9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25
-
SHA512
00334d94601f35db1a0d6c3e2d9b6c6981b386bf3845ecbd786e86e5e775578b568c2db75ad1f0587cd17dba1ce36a06f7d2a598cb2872767d9588c57adba2d5
-
SSDEEP
12288:uSazSusUabSl3jl4EkYHJzhZoTLxFHuiN:uL3R4EjVyLnOiN
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 6 IoCs
resource yara_rule behavioral1/memory/1804-58-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1804-61-0x0000000000401180-mapping.dmp family_isrstealer behavioral1/memory/1804-60-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1804-69-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1804-78-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1804-79-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/1848-75-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/1848-76-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/1848-80-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 3 IoCs
resource yara_rule behavioral1/memory/1848-75-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/1848-76-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/1848-80-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
resource yara_rule behavioral1/memory/1848-70-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1848-74-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1848-75-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1848-76-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1848-80-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts RegSvcs.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1004 set thread context of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1804 set thread context of 1656 1804 RegSvcs.exe 30 PID 1804 set thread context of 1848 1804 RegSvcs.exe 31 PID 1004 set thread context of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1804 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1004 wrote to memory of 1804 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 29 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1656 1804 RegSvcs.exe 30 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1804 wrote to memory of 1848 1804 RegSvcs.exe 31 PID 1004 wrote to memory of 1856 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 32 PID 1004 wrote to memory of 1856 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 32 PID 1004 wrote to memory of 1856 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 32 PID 1004 wrote to memory of 1856 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 32 PID 1004 wrote to memory of 1856 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 32 PID 1004 wrote to memory of 1856 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 32 PID 1004 wrote to memory of 1856 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 32 PID 1004 wrote to memory of 1760 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 33 PID 1004 wrote to memory of 1760 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 33 PID 1004 wrote to memory of 1760 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 33 PID 1004 wrote to memory of 1760 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 33 PID 1004 wrote to memory of 1760 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 33 PID 1004 wrote to memory of 1760 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 33 PID 1004 wrote to memory of 1760 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 33 PID 1004 wrote to memory of 928 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 34 PID 1004 wrote to memory of 928 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 34 PID 1004 wrote to memory of 928 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 34 PID 1004 wrote to memory of 928 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 34 PID 1004 wrote to memory of 928 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 34 PID 1004 wrote to memory of 928 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 34 PID 1004 wrote to memory of 928 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 34 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35 PID 1004 wrote to memory of 836 1004 9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe"C:\Users\Admin\AppData\Local\Temp\9d978ed6ac2d5d4d980fb8d4f2190225b1e73ed0c1858f6cdded840c2f579b25.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe/scomma "C:\Users\Admin\AppData\Local\Temp\woH3wasmQN.ini"3⤵PID:1656
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe/scomma "C:\Users\Admin\AppData\Local\Temp\xl7bkuN8Xg.ini"3⤵
- Accesses Microsoft Outlook accounts
PID:1848
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /FSILlzCwXB /C:\Users\Admin\AppData\Roaming\FSILlzCwXB\FSILlzCwXB.exe2⤵PID:1856
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /FSILlzCwXB /C:\Users\Admin\AppData\Roaming\FSILlzCwXB\FSILlzCwXB.exe2⤵PID:1760
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /FSILlzCwXB /C:\Users\Admin\AppData\Roaming\FSILlzCwXB\FSILlzCwXB.exe2⤵PID:928
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /FSILlzCwXB /C:\Users\Admin\AppData\Roaming\FSILlzCwXB\FSILlzCwXB.exe2⤵PID:836
-