Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe
Resource
win10v2004-20220812-en
General
-
Target
dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe
-
Size
1008KB
-
MD5
d0d9e35c7366d20c4e2996600b5e32fb
-
SHA1
b4f2b3bbffc7be2d643c3977c7ca864eed6ceb86
-
SHA256
dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65
-
SHA512
7b0278294f08787fda49b366a535ba0bb9fd3a213d70b2afa6e03746e226a14602c02a13d2e275b9337187ecb31579e49067c6b5378c9b03a2b7f75586d854cf
-
SSDEEP
24576:NP3tMh0BxZC6AXPtWskmkNbY1XQXUpTfkDXfJH:R3tMh0k7PPkmPAMjkzB
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 5 IoCs
resource yara_rule behavioral1/memory/1128-60-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1128-62-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1128-63-0x0000000000401180-mapping.dmp family_isrstealer behavioral1/memory/1128-70-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral1/memory/1128-84-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/1644-81-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/1644-82-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 2 IoCs
resource yara_rule behavioral1/memory/1644-81-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/1644-82-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
resource yara_rule behavioral1/memory/984-68-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/984-73-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/984-74-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/984-75-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/1644-76-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1644-80-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1644-81-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1644-82-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/984-83-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1360 set thread context of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1128 set thread context of 984 1128 vbc.exe 29 PID 1128 set thread context of 1644 1128 vbc.exe 30 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1128 vbc.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1360 wrote to memory of 1128 1360 dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe 28 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 984 1128 vbc.exe 29 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30 PID 1128 wrote to memory of 1644 1128 vbc.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe"C:\Users\Admin\AppData\Local\Temp\dd42fa589c17688c69afb046241371cec15b8049aa06c53b0f27acc5af727c65.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\A8GEzjeq3z.ini"3⤵PID:984
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\gjpjZrLiFB.ini"3⤵
- Accesses Microsoft Outlook accounts
PID:1644
-
-