Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09/03/2023, 13:56

General

  • Target

    0c416e462853425ce474820d82ed8212.exe

  • Size

    1.0MB

  • MD5

    0c416e462853425ce474820d82ed8212

  • SHA1

    f008aba5a83a167663be86bcb0230232c74029f7

  • SHA256

    e83c5b4a9fbfb2294eeb8be89c3d871ad2f20b776bf9594bd0b0ecd288ad47f8

  • SHA512

    b0538d150b11fd7570d2d6c6f55aa2d6c9dde0cad96beb19db108b9e53019b7fb5a8d412f3c92c8b8e9be1f6e67a7ce36ad82b5c1e91c85ca866cf0b30f8d917

  • SSDEEP

    24576:EuOZ6wGkB+e9uf8mS8mONRMbeze6aKQoW7y0nkO:P39Y6aKQmmkO

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    citalmet.com.ar
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    payment@123

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c416e462853425ce474820d82ed8212.exe
    "C:\Users\Admin\AppData\Local\Temp\0c416e462853425ce474820d82ed8212.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0c416e462853425ce474820d82ed8212.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:628
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nijiOvNtapSp.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:580
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nijiOvNtapSp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD5B7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1164
    • C:\Users\Admin\AppData\Local\Temp\0c416e462853425ce474820d82ed8212.exe
      "C:\Users\Admin\AppData\Local\Temp\0c416e462853425ce474820d82ed8212.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1736

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpD5B7.tmp

    Filesize

    1KB

    MD5

    c0decf782e6d5703bae4512cac554b77

    SHA1

    82446d81a27562aca86b56bfc76e75592e83a240

    SHA256

    b0e1fa00c7515b28a7383baef137501d5717fdecca79b8b96ea06cb938067b13

    SHA512

    84f0ca34a505ad936c60e58179c7edc4d9f8704500da9fa76926da299095cbd181529e19631b36f3f8a6f2d2d877582e2e1d947b9159ba6ee03b82523477cacf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JZ77LUDT6IGCP5R0L2PY.temp

    Filesize

    7KB

    MD5

    fc52105ff0c9506aca18899f87ba1057

    SHA1

    6fe23e035a03c4a1e33b4cb83aaed4998ce43ac4

    SHA256

    373719deae9d522b8d9acd539e71ac50dbbea32f7d9b6bb65779e9c95627e3f3

    SHA512

    88d86db321d12fd7eac1ccd6485c51c07ffbd7b0fe04c67cf89483463386431393d09ca826c0cb3876cb9e215aa9df7a6fd9d466f0067ef5abae04be3092e0e7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    fc52105ff0c9506aca18899f87ba1057

    SHA1

    6fe23e035a03c4a1e33b4cb83aaed4998ce43ac4

    SHA256

    373719deae9d522b8d9acd539e71ac50dbbea32f7d9b6bb65779e9c95627e3f3

    SHA512

    88d86db321d12fd7eac1ccd6485c51c07ffbd7b0fe04c67cf89483463386431393d09ca826c0cb3876cb9e215aa9df7a6fd9d466f0067ef5abae04be3092e0e7

  • memory/580-84-0x0000000002620000-0x0000000002660000-memory.dmp

    Filesize

    256KB

  • memory/628-83-0x0000000002740000-0x0000000002780000-memory.dmp

    Filesize

    256KB

  • memory/836-55-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/836-56-0x0000000000230000-0x0000000000244000-memory.dmp

    Filesize

    80KB

  • memory/836-57-0x00000000049D0000-0x0000000004A10000-memory.dmp

    Filesize

    256KB

  • memory/836-58-0x0000000000380000-0x000000000038C000-memory.dmp

    Filesize

    48KB

  • memory/836-59-0x0000000005890000-0x0000000005932000-memory.dmp

    Filesize

    648KB

  • memory/836-72-0x00000000012D0000-0x00000000012F8000-memory.dmp

    Filesize

    160KB

  • memory/836-54-0x0000000001360000-0x000000000146C000-memory.dmp

    Filesize

    1.0MB

  • memory/1736-73-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1736-76-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1736-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1736-78-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1736-80-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1736-82-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1736-75-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1736-74-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB