Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2023, 01:50

General

  • Target

    5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe

  • Size

    1.1MB

  • MD5

    ec7c37ae9c0377f3240a274290c9c214

  • SHA1

    432915cb9e9e860a84e142719bf0e82392c69a6a

  • SHA256

    5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f

  • SHA512

    326f282eb2a8c6f79de6f7019fc7d16be88345467301bc1d28c36f5c7094ac38ec206dc068d24c8bcecd0cb02e39af1d5070f839f9518f0e8e149ac5c5c0c576

  • SSDEEP

    24576:KZUu39V1vMSb4gz1o5Ti81zSdyrjLDjFPR6KrXmTDa:yltsSkW1o5Tiouy/z6KrXmX

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5916787654:AAEJEadEk6VSBHL82vTGRS9aaNuh-zG53Rg/sendMessage?chat_id=5483672364

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe
    "C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1488
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrErGuxRXcieO.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:568
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrErGuxRXcieO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B65.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1664
    • C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe
      "C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:316
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp2B65.tmp

    Filesize

    1KB

    MD5

    24e63bbda543a6ecc8304102ea207433

    SHA1

    5da95813d0d18f29227e28aa74df259f1afab506

    SHA256

    dc775fdb8d4f9d7556687c438613ab8c7307ed2b9a2608d26aadbec15b815285

    SHA512

    77703203b7d3d59ebae1d37f7ac09387a1dee6edb2e30c001968a1215faf7a952ab140d04e367388f1eadec7869b41c7119fb3b06f2ff6c08d503f55869db446

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HD0NEP5HWA63RTR2Z7G9.temp

    Filesize

    7KB

    MD5

    c35ccf09f232f0405901e31abd0e1eb4

    SHA1

    45d53cceb4805ca5f8a47c9768bb8f5ef4495c25

    SHA256

    08abd89549efea4b4f2d7f5001530f0f30b33e1d348a13fcc42fdbf30e45c74d

    SHA512

    0cc02593ee914f58f1395731a6a0a00fd26aa54e3bf167a5c059e06e5bd81d7c6d03421a67dee16a6b119d362da2bd1bef08cf77f578b429c35cd37a21d28b58

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    c35ccf09f232f0405901e31abd0e1eb4

    SHA1

    45d53cceb4805ca5f8a47c9768bb8f5ef4495c25

    SHA256

    08abd89549efea4b4f2d7f5001530f0f30b33e1d348a13fcc42fdbf30e45c74d

    SHA512

    0cc02593ee914f58f1395731a6a0a00fd26aa54e3bf167a5c059e06e5bd81d7c6d03421a67dee16a6b119d362da2bd1bef08cf77f578b429c35cd37a21d28b58

  • memory/316-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/316-79-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/316-92-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/316-82-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/316-77-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/316-74-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/316-72-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/316-73-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/568-83-0x0000000002280000-0x00000000022C0000-memory.dmp

    Filesize

    256KB

  • memory/812-88-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/812-84-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/812-85-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/812-86-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/812-90-0x00000000000D0000-0x0000000000136000-memory.dmp

    Filesize

    408KB

  • memory/812-91-0x0000000000930000-0x00000000009EC000-memory.dmp

    Filesize

    752KB

  • memory/1972-55-0x0000000004A10000-0x0000000004A50000-memory.dmp

    Filesize

    256KB

  • memory/1972-58-0x0000000007FF0000-0x00000000080DC000-memory.dmp

    Filesize

    944KB

  • memory/1972-56-0x0000000000520000-0x0000000000540000-memory.dmp

    Filesize

    128KB

  • memory/1972-54-0x0000000001110000-0x0000000001224000-memory.dmp

    Filesize

    1.1MB

  • memory/1972-71-0x0000000008620000-0x0000000008696000-memory.dmp

    Filesize

    472KB

  • memory/1972-57-0x0000000000590000-0x000000000059C000-memory.dmp

    Filesize

    48KB