Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    82s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2023, 14:20

General

  • Target

    Confirmación de recibo de transferencia.exe

  • Size

    621KB

  • MD5

    34aad4cf4e2eaff477944be25df41837

  • SHA1

    ed808f2f8b9634e8a513401122ad8b03152742b5

  • SHA256

    6fa45e57a0c10b280baeef2d8a446499a2fd29f5745535cb8f7e0c0d51852009

  • SHA512

    136f30226265ad4e1d73cf67c10ba9f035409222cb64fa06d68d71d2fdd9e362128902fdbbbfe01510004e29e37ab1819ca61f7777f0946a6cd9df8dfc71c0c5

  • SSDEEP

    12288:buFqUvdP5Kq/XpKQKr2fjJswmvTPVj9Y/:bpUvKq/pKx2fjmwETt9

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.condominioaocubo.pt
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Qualidade.c3.2018

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 7 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Confirmación de recibo de transferencia.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirmación de recibo de transferencia.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Users\Admin\AppData\Local\Temp\Confirmación de recibo de transferencia.exe
      "C:\Users\Admin\AppData\Local\Temp\Confirmación de recibo de transferencia.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:320

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/320-66-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/320-68-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/320-72-0x0000000004A70000-0x0000000004AB0000-memory.dmp

    Filesize

    256KB

  • memory/320-71-0x0000000004A70000-0x0000000004AB0000-memory.dmp

    Filesize

    256KB

  • memory/320-70-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/320-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/320-63-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/320-61-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/320-62-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/320-64-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1108-55-0x0000000005030000-0x0000000005070000-memory.dmp

    Filesize

    256KB

  • memory/1108-60-0x0000000001F30000-0x0000000001F58000-memory.dmp

    Filesize

    160KB

  • memory/1108-54-0x0000000000890000-0x0000000000932000-memory.dmp

    Filesize

    648KB

  • memory/1108-59-0x00000000020B0000-0x0000000002112000-memory.dmp

    Filesize

    392KB

  • memory/1108-58-0x0000000000430000-0x000000000043C000-memory.dmp

    Filesize

    48KB

  • memory/1108-57-0x0000000005030000-0x0000000005070000-memory.dmp

    Filesize

    256KB

  • memory/1108-56-0x0000000000410000-0x0000000000424000-memory.dmp

    Filesize

    80KB