Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe
Resource
win10v2004-20221111-en
General
-
Target
d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe
-
Size
1.7MB
-
MD5
8e909b372d7d2e2dd9c4009860353785
-
SHA1
49980560942fb08f9682f5f5f9fc9776f25c4ea3
-
SHA256
d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e
-
SHA512
8ce9c2e5f1d2eb6e00f2dc95d1c13c3de455017bdd5ca1547751ad5fe686f88833bfcd9e5daf57c3d0cc32d3e3def917138cf5728a15034b57fbeff137e35bac
-
SSDEEP
49152:30cWXWjEJJ83Os4Gi1t4bdvBUgTGLxiuZ7t:35+qEr837/HExiuZB
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/1768-66-0x0000000000400000-0x0000000000414000-memory.dmp family_isrstealer behavioral1/memory/1768-67-0x0000000000400000-0x0000000000414000-memory.dmp family_isrstealer behavioral1/memory/1768-68-0x00000000004011F0-mapping.dmp family_isrstealer behavioral1/memory/1768-75-0x0000000000401000-0x0000000000412000-memory.dmp family_isrstealer -
Executes dropped EXE 3 IoCs
pid Process 1412 explorer.exe 1984 WinRAR.4.11.x64.en.exe 1296 Process not Found -
Loads dropped DLL 5 IoCs
pid Process 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1412 set thread context of 1768 1412 explorer.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main WinRAR.4.11.x64.en.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1412 explorer.exe 1412 explorer.exe 1768 AppLaunch.exe 1768 AppLaunch.exe 1768 AppLaunch.exe 1768 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1412 explorer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1768 AppLaunch.exe 1984 WinRAR.4.11.x64.en.exe 1984 WinRAR.4.11.x64.en.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1220 wrote to memory of 1412 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 27 PID 1220 wrote to memory of 1412 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 27 PID 1220 wrote to memory of 1412 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 27 PID 1220 wrote to memory of 1412 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 27 PID 1220 wrote to memory of 1412 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 27 PID 1220 wrote to memory of 1412 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 27 PID 1220 wrote to memory of 1412 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 27 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1412 wrote to memory of 1768 1412 explorer.exe 28 PID 1220 wrote to memory of 1984 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 29 PID 1220 wrote to memory of 1984 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 29 PID 1220 wrote to memory of 1984 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 29 PID 1220 wrote to memory of 1984 1220 d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe"C:\Users\Admin\AppData\Local\Temp\d21e0a13be0061653b88d7a5c62299f7658ff7f82e372760233ba775622a997e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\explorer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinRAR.4.11.x64.en.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinRAR.4.11.x64.en.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5dfd98fdf22cae97d52e93521bb99e42a
SHA1f554deaf3b169f6a2598d5773087377f94395418
SHA2566b764143299e51e2fc384012000959ac5eb94f08a0ab405e8d38f0509bfd5328
SHA512fc56b6d83ff2b1e8b955881dc49a5d117002b62f0579d681d84a27370f84cc1ecdc56f06593b6bdfdb4b3e39af1df610943d9723ead48c7f4b2d64c4aa3b5679
-
Filesize
1.6MB
MD5dfd98fdf22cae97d52e93521bb99e42a
SHA1f554deaf3b169f6a2598d5773087377f94395418
SHA2566b764143299e51e2fc384012000959ac5eb94f08a0ab405e8d38f0509bfd5328
SHA512fc56b6d83ff2b1e8b955881dc49a5d117002b62f0579d681d84a27370f84cc1ecdc56f06593b6bdfdb4b3e39af1df610943d9723ead48c7f4b2d64c4aa3b5679
-
Filesize
157KB
MD51b65568bc870cca49117f9ebb3cd2d59
SHA18221ed9e44ff774c170f8c95f42133b305df6a4d
SHA25687027d70026820e045d60273da56dcd87b79201857e5884502ee06d2a5258e42
SHA5129791d13ab9542d813be3639b5a15b425fcd744526d16d2cf04055ad387e63540cd4fdab8e31403107536d9f4dfd3c5afc132158449312bab03204f52c61ad868
-
Filesize
157KB
MD51b65568bc870cca49117f9ebb3cd2d59
SHA18221ed9e44ff774c170f8c95f42133b305df6a4d
SHA25687027d70026820e045d60273da56dcd87b79201857e5884502ee06d2a5258e42
SHA5129791d13ab9542d813be3639b5a15b425fcd744526d16d2cf04055ad387e63540cd4fdab8e31403107536d9f4dfd3c5afc132158449312bab03204f52c61ad868
-
Filesize
1.6MB
MD5dfd98fdf22cae97d52e93521bb99e42a
SHA1f554deaf3b169f6a2598d5773087377f94395418
SHA2566b764143299e51e2fc384012000959ac5eb94f08a0ab405e8d38f0509bfd5328
SHA512fc56b6d83ff2b1e8b955881dc49a5d117002b62f0579d681d84a27370f84cc1ecdc56f06593b6bdfdb4b3e39af1df610943d9723ead48c7f4b2d64c4aa3b5679
-
Filesize
1.6MB
MD5dfd98fdf22cae97d52e93521bb99e42a
SHA1f554deaf3b169f6a2598d5773087377f94395418
SHA2566b764143299e51e2fc384012000959ac5eb94f08a0ab405e8d38f0509bfd5328
SHA512fc56b6d83ff2b1e8b955881dc49a5d117002b62f0579d681d84a27370f84cc1ecdc56f06593b6bdfdb4b3e39af1df610943d9723ead48c7f4b2d64c4aa3b5679
-
Filesize
157KB
MD51b65568bc870cca49117f9ebb3cd2d59
SHA18221ed9e44ff774c170f8c95f42133b305df6a4d
SHA25687027d70026820e045d60273da56dcd87b79201857e5884502ee06d2a5258e42
SHA5129791d13ab9542d813be3639b5a15b425fcd744526d16d2cf04055ad387e63540cd4fdab8e31403107536d9f4dfd3c5afc132158449312bab03204f52c61ad868
-
Filesize
157KB
MD51b65568bc870cca49117f9ebb3cd2d59
SHA18221ed9e44ff774c170f8c95f42133b305df6a4d
SHA25687027d70026820e045d60273da56dcd87b79201857e5884502ee06d2a5258e42
SHA5129791d13ab9542d813be3639b5a15b425fcd744526d16d2cf04055ad387e63540cd4fdab8e31403107536d9f4dfd3c5afc132158449312bab03204f52c61ad868
-
Filesize
157KB
MD51b65568bc870cca49117f9ebb3cd2d59
SHA18221ed9e44ff774c170f8c95f42133b305df6a4d
SHA25687027d70026820e045d60273da56dcd87b79201857e5884502ee06d2a5258e42
SHA5129791d13ab9542d813be3639b5a15b425fcd744526d16d2cf04055ad387e63540cd4fdab8e31403107536d9f4dfd3c5afc132158449312bab03204f52c61ad868
-
Filesize
157KB
MD51b65568bc870cca49117f9ebb3cd2d59
SHA18221ed9e44ff774c170f8c95f42133b305df6a4d
SHA25687027d70026820e045d60273da56dcd87b79201857e5884502ee06d2a5258e42
SHA5129791d13ab9542d813be3639b5a15b425fcd744526d16d2cf04055ad387e63540cd4fdab8e31403107536d9f4dfd3c5afc132158449312bab03204f52c61ad868