Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2023, 01:50

General

  • Target

    5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe

  • Size

    1.1MB

  • MD5

    ec7c37ae9c0377f3240a274290c9c214

  • SHA1

    432915cb9e9e860a84e142719bf0e82392c69a6a

  • SHA256

    5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f

  • SHA512

    326f282eb2a8c6f79de6f7019fc7d16be88345467301bc1d28c36f5c7094ac38ec206dc068d24c8bcecd0cb02e39af1d5070f839f9518f0e8e149ac5c5c0c576

  • SSDEEP

    24576:KZUu39V1vMSb4gz1o5Ti81zSdyrjLDjFPR6KrXmTDa:yltsSkW1o5Tiouy/z6KrXmX

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5916787654:AAEJEadEk6VSBHL82vTGRS9aaNuh-zG53Rg/sendMessage?chat_id=5483672364

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe
    "C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3820
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QrErGuxRXcieO.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1284
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QrErGuxRXcieO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD1A8.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2484
    • C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe
      "C:\Users\Admin\AppData\Local\Temp\5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:1904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    236ddb92456f45b2bfb5bfe171f21dd9

    SHA1

    e3945b285b6edc53c576220fa2c3997b593d3ac1

    SHA256

    674f9a7248b0e9d0f61f36a7e018ca1803e4435c5a32eb71934e48da4107f5bb

    SHA512

    8c1d2ccf5e8a7625bfd2548decbbcebcfac369aebb0b80e93d4f42b80cc86148e01e53c9e7bcc8795adfee200885e19c1394849a6a7bac789df10243c5498617

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_45cogf3j.4mj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpD1A8.tmp

    Filesize

    1KB

    MD5

    64fa64353ecf4a60b79da851f7ae8f1a

    SHA1

    d2d09b6eba7d728b0e970e36a9aea7fd8b3f783e

    SHA256

    0f44664f0eaf45d95f4917e53db395a43e47295f0a46933803b404eabc2803a7

    SHA512

    5a3dcda672aa3cb83c4ecc609b97eee24947e576c3b030d6c68ab0ee9097465ac1dcf294f6759b22168041c99daf329b0d65986039a29c17bd6c94f7d800fe32

  • memory/1284-145-0x00000000053F0000-0x0000000005A18000-memory.dmp

    Filesize

    6.2MB

  • memory/1284-211-0x0000000007820000-0x00000000078B6000-memory.dmp

    Filesize

    600KB

  • memory/1284-181-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

    Filesize

    64KB

  • memory/1284-205-0x000000007F3B0000-0x000000007F3C0000-memory.dmp

    Filesize

    64KB

  • memory/1284-162-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

    Filesize

    64KB

  • memory/1284-182-0x0000000007240000-0x0000000007272000-memory.dmp

    Filesize

    200KB

  • memory/1284-178-0x0000000006290000-0x00000000062AE000-memory.dmp

    Filesize

    120KB

  • memory/1284-209-0x0000000007610000-0x000000000761A000-memory.dmp

    Filesize

    40KB

  • memory/1284-150-0x0000000005360000-0x00000000053C6000-memory.dmp

    Filesize

    408KB

  • memory/1284-184-0x00000000708A0000-0x00000000708EC000-memory.dmp

    Filesize

    304KB

  • memory/1284-155-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

    Filesize

    64KB

  • memory/1284-206-0x0000000007BE0000-0x000000000825A000-memory.dmp

    Filesize

    6.5MB

  • memory/1284-212-0x00000000077D0000-0x00000000077DE000-memory.dmp

    Filesize

    56KB

  • memory/1608-221-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/1608-156-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/1608-148-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/1608-179-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/1904-208-0x0000000001300000-0x0000000001366000-memory.dmp

    Filesize

    408KB

  • memory/3220-133-0x0000000000FA0000-0x00000000010B4000-memory.dmp

    Filesize

    1.1MB

  • memory/3220-139-0x0000000008B00000-0x0000000008B9C000-memory.dmp

    Filesize

    624KB

  • memory/3220-138-0x0000000005D30000-0x0000000005D40000-memory.dmp

    Filesize

    64KB

  • memory/3220-137-0x0000000005D30000-0x0000000005D40000-memory.dmp

    Filesize

    64KB

  • memory/3220-136-0x0000000005A70000-0x0000000005A7A000-memory.dmp

    Filesize

    40KB

  • memory/3220-135-0x0000000005AA0000-0x0000000005B32000-memory.dmp

    Filesize

    584KB

  • memory/3220-134-0x0000000006050000-0x00000000065F4000-memory.dmp

    Filesize

    5.6MB

  • memory/3820-147-0x0000000005210000-0x0000000005232000-memory.dmp

    Filesize

    136KB

  • memory/3820-207-0x00000000075E0000-0x00000000075FA000-memory.dmp

    Filesize

    104KB

  • memory/3820-204-0x000000007F710000-0x000000007F720000-memory.dmp

    Filesize

    64KB

  • memory/3820-194-0x00000000068A0000-0x00000000068BE000-memory.dmp

    Filesize

    120KB

  • memory/3820-183-0x00000000708A0000-0x00000000708EC000-memory.dmp

    Filesize

    304KB

  • memory/3820-180-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

    Filesize

    64KB

  • memory/3820-151-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

    Filesize

    64KB

  • memory/3820-213-0x0000000007920000-0x000000000793A000-memory.dmp

    Filesize

    104KB

  • memory/3820-214-0x0000000007900000-0x0000000007908000-memory.dmp

    Filesize

    32KB

  • memory/3820-154-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

    Filesize

    64KB

  • memory/3820-153-0x0000000005B30000-0x0000000005B96000-memory.dmp

    Filesize

    408KB

  • memory/3820-144-0x00000000029D0000-0x0000000002A06000-memory.dmp

    Filesize

    216KB