Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05/05/2023, 14:29
General
-
Target
Technical Spec.exe
-
Size
1.5MB
-
MD5
ebf99fc11603d1ec4706b4330761df32
-
SHA1
c560ca5ae10593d7861701654d839d1071515866
-
SHA256
693c258cb5620f7e8714d4afc7215e2c7dc16872265148341db23b639906eecb
-
SHA512
d31c699f201343bd02c07bbf5d41e00df8368b81bfbb1d037fb4b1e1894fd3b8232e80b065845745fa6dab7f23d47efbb1d8b6a9143f5b7db0fb4a57395c4f4a
-
SSDEEP
49152:NQh9Nn3uFcWIY2YZGIUtNlMpovD2i9c2:0/37Wp2YPUtNlMG7N
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"C:\Users\Admin\AppData\Local\Temp\Technical Spec.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD564c5488bee8343dfa303d77a98ef1f52
SHA111d4f229c558bf847a2275cbceef5ab9c65e968c
SHA256363f326de89f51c47e7450e83f05f43c55e00bca8922e6fe07c2168d95eb8bbe
SHA5124897ae6575ec381070e7d8681d1f29c4194d9a7054429b7d94856c59b2bd7c9afd2bf6e237e766eca36638210c2c240c117f32b4ec6cea4d714f39f63993645d
-
Filesize
1.4MB
MD59064291bb467d488530e7c4445417412
SHA17adc937db69ef36dbaa06913d13334e8e8c09bf3
SHA256cbcb4a1d8f917f7490945cd98739bc9e774a3325d124de64482d5869a9500531
SHA512e7907b959a5f8fca6d35805223fe5912da3dbe6e267eedc73c17e1699333d7742eea8ce80168840aebe01815bd0d200f935221dbac746e3c23da5e50d542e7ba
-
Filesize
1.5MB
MD5e88eceee1657905b1e5435c287afec58
SHA1935fa19b6f1bf14fcc7e653cbd85f493780226c1
SHA256d111c8505d47349516e082146002b1f6b52408a1abfb1091ec2954d512d9489e
SHA5125e8fd7c1d482ae5809e57c2237424b3f92e920d50cb196aede5699defe05fd7cbcb162e8a9b34e5f7209efa7ace56a7665b4fa92f6ae49094820fcbadeda67db
-
Filesize
2.1MB
MD58e261076202bd95f1168fcadbb417963
SHA1a60978a1069deea10dc30779744be4bc25436258
SHA256f55d318df48c9b1611ec3ca0952c799bee0f8ba35f749706581b81e13b50e29c
SHA512d5953d95f959324d30df95bd23ab86a5b27f0a2bbaab86fc8aa79f8a11ce904138280d4aa1a4f7606d3c3aadb6053cbbb819b01d3f63939fa90caaa6f36a6fbb
-
Filesize
1.2MB
MD5ea5ad2e96ae12e3354c2c5bc261d80e1
SHA1cae65ee31d965c935325150e0209058865ac0713
SHA2564a708505d7a6b53112e0e3886db34d79b1fac2645a94cf6dbea65df6bad4941c
SHA512b8430f0103e42f1c4b401ce07bf91516aacbc1eca429dcf702bacf3a49ef40f6350e2f16d2cc545f2e7b353edbd8e1171650898718ca9143bedf931c5320bd96
-
Filesize
1.7MB
MD508646b9aed857843892550bab89ce757
SHA186f32fbb6b81754de0023bd9f6b826c5df1bd1c8
SHA256c72c7211926ab359fb342b346cff54400d233d3a63fffa7357833eee8482c88f
SHA512ead539c17441c8044a9c3b368d661e94d7b02b8ae2671a696dff9285daf5ef811ab0b029ce0152e4071d720b256354e401b5e035097a2b5a5659438326e33830
-
Filesize
1.3MB
MD5ee633a6c7985d55097bdf2e3ae0fee5f
SHA16a5cd3771d8a6e12909a1110173c0a93a720a7ab
SHA256d9ccbe84b7ba16a2113407750385263ded4b8fe3b321e53dc1cb808fcf83cdc3
SHA512468cceb2ba9868f90f2cdda535e2a301898344cf393dec9a00f611797d8d9b89257f4c2785fb4e0abf3800a964f6590c521b2ff0047d513b7ae653ce1123b001
-
Filesize
1.2MB
MD5f5779cc221428913345a2dca72348a6c
SHA1c066369df30d5ab5036c5ab65b53a226272510ee
SHA25678de112a408aae7fe6c0e313360a8fb1b15952b6c2285118697fca88f0503a67
SHA5124e6ec5c5d6a076cf04b6f78510747ac62915cdb8ffd08488cdadc48dc0fc0481d8699d5bd5d04fcf0d532be7d00505cb04878a299112ce4d1a0320608d108e6c
-
Filesize
1.2MB
MD5328c4c0fb03c180cf3e6bb6c6b450b1b
SHA147c511110b0e6f693275018ed76cde68ac9b31c1
SHA256895ef0a00ba9e8f9ddcc77e5ce8b3fe62bba9c1ca1b265f76cb7bb4f36f09695
SHA512bd64ca3499ed5190c88f74c49eb565a2b2d82437d23627ef4ce6d38140861560d43a755059aca6a337982bdf25c2e30ee4bfd12a638c3ec58b07619001c04776
-
Filesize
1.6MB
MD565fd4e3f4c702fec5534785a9035def6
SHA1c5f6ca6b8baf70306f4c072a455e6ed07734df70
SHA2568be5f62e10ee97067b120f6b8c1b4a72d03bb68b69aed68b84f47fc797f52798
SHA512b3891ae754a3d07e509dffc3c52897ec314aa6de2e8be160795216f723395b76875a09309dd9c22734292b70b591373934bc68361b563af629e8a131d6ce5edd
-
Filesize
1.6MB
MD565fd4e3f4c702fec5534785a9035def6
SHA1c5f6ca6b8baf70306f4c072a455e6ed07734df70
SHA2568be5f62e10ee97067b120f6b8c1b4a72d03bb68b69aed68b84f47fc797f52798
SHA512b3891ae754a3d07e509dffc3c52897ec314aa6de2e8be160795216f723395b76875a09309dd9c22734292b70b591373934bc68361b563af629e8a131d6ce5edd
-
Filesize
1.3MB
MD51d329e694a2a76e89da96422725918e6
SHA147446d62603e69da390fbbfdbb8a443a4e434089
SHA256fe61af9edbe86c5838c004f2d8fc67c5c59f8cd773ddbbce85e8d244979772ef
SHA512a9c7bb6b139832c9b4d180f2518a75414abb38b26c172aa129ffc50b062c8168050c99aaf79c7307360bf41d18f72c9311503461e991fe1aaabf71bd4cc3f212
-
Filesize
1.4MB
MD57a89149101aecc89517ccc9cd415ba32
SHA10e758abfb9d4c6064d550cbfd242a19e0595d673
SHA2562d91e96094a0a93d8d8eed14ca8ee43678dbb207ceb5aaa82b5160a3d4e0baa4
SHA5120aa8633c5f0345527c404efd2d449500e8c2e31d7e9da7648235915b2b18fdee2878f7d40395de9e83109bfbb1ea0bf2a2c26affa42e20b6be092afcdc2396bb
-
Filesize
1.8MB
MD5bee720a8cf5a535925cf11087ce94b1b
SHA1c3fa7f88b1cf967ff421b9acf34f15df0a30de38
SHA256f028b01146243d4c4605b0e1c13d7f7a60ad9eddf70e897930e50f3e16cebc71
SHA51267fbc8d63a3af8990e535412beaa60192447b3fd57f2e287704147d810168599a4751ba013e7812c3c68cc689c35b8a8df9816960533ef232f0a0e88e87b409b
-
Filesize
1.4MB
MD5418bd8c1cdb51bd5b61fa183d4f8260c
SHA18d595d18b605e0f48be03ce7722b39820824d179
SHA256948dc04344675662bb6c3b8418a72bc21a5bd889360aaa6bdeedb79704838035
SHA51215d282e8a1e39ee958a9f671cf5fcec896dd0e1fdbc040172a84e3d2c4106861bb2befcbf59790944319374393fda68101444612cbc4983627461c47978de4c2
-
Filesize
1.5MB
MD5c8207709277e603fa28b36e6400d89f5
SHA15c44846e9469bd8ee03566d8d06ee827d5fe92bb
SHA2562009c11cf518719694e0c9f8a418cd9c1e7a6f635d7735bbaee9eb28891ee59c
SHA5124fab11c2626a9fc78c6839e79782403759fa269eeb5f367303d00e45508d2aa6b44018d574ea86430dd5519e36ca68d4462c89092562dd9ff84d2c316a5ff51d
-
Filesize
2.0MB
MD5158809c1d439e02c0ae2345a3ee96a43
SHA1ffc1eb6dfa43fb95db82144a7163ce071d587abd
SHA2565128af5bca31f38aebad1b61beadd3519c34357e28573be175c3eca59dd021ae
SHA512cd3687a153a1f3a1616cb73654d9add3c456494bfa44c98e6e80eb071a64ebd544e48913aa9025802dabfd3cc2dc76a8903cfbb234ca9be407ecac35e70be582
-
Filesize
1.3MB
MD5e3bd5cd231d853496d241ce00ff3b626
SHA14fe271117fb71024ca7c5cbf75835c6c7fdf6220
SHA2564ec498741b4328ca8fa8d8f1b6f47dfbbd39d61844e65ab7c72d98c13d6136fb
SHA512ad87e1aa1951f1e2156a12faf3a1143e302faac7b6e898737a35ca690ba4789893e950a208c8cd6dc8d0c8f4cd28f0ec6bb293b166a23c7b4f56c40debb0e042
-
Filesize
1.4MB
MD5a689d04df328b975042d8996ccdf6110
SHA1c5b60a193c8dc3840e51a1cc8a3f4cfa26c9a1ab
SHA256861c60b23900e7f0b5c7d3c73484f462a11a4b2a0e38ee8c2c7f01ef8ffac727
SHA5122b7ed8bcbfbaac959ca4abf44008ee7a5b454c2d0c3328f7fbe4839de7c3208397970937a15827548b27e59afd797b377846614134e14146474af5598563a2e1
-
Filesize
1.2MB
MD5f57d5793d9ca605456e0dde8c2423383
SHA1d4c8ed849b24df58bc8a0604282891b9fbc3d417
SHA256fd80edc6c5c77adde263f8729d2e3b8624a3785b9d8794090515ee14ce06853a
SHA51227b09db72d1af51795d298371a4d18a12a7ae42df7992cfebfb11cc8877fab081283230f2c205799607f1f43e13290994258b58708e4f57fa98129c982866fa3
-
Filesize
1.3MB
MD56267ba960f5264dc03a68339b5432494
SHA19bc7b7518bedc86f0a247893d650098e462fc4cc
SHA256a2dae07d278856b26911d02b4d581bb77c405f1214d180c4cca58c9f38beb672
SHA51280a11da58faadcaadd90a28abf8746129a215d3801e967dfec757bdfa40a5b9eb6d7f0269e1d615ce1f6829c36a56d8b26511dadf09f78ce590ae776bf3dd477
-
Filesize
1.4MB
MD5299f5f02d7b335094b603cf1f6ae8924
SHA1f6747a986a6d756ba8f3b08c2feb0bc5854b1e6c
SHA25614fb6dd2d4b2cd78ffd7b4a67662b9cb56a24306ea40897ea5941c62bd7c0a9f
SHA512562f8aa057f44f99bb54382696009d0ac6969311f0eba3c4cadadc13b592d0b1eecf6cb99ed21dd98121005d83b2483518311dbd34520c754154cca7e1c89321
-
Filesize
2.1MB
MD5fd05fb939148348ac6c250673c7d4565
SHA11aa5248e5989a6b71c200c51e9710ed09a62f94e
SHA25603520097f94e9ce51a74d4c95314f0df9b2d7daf2ca8c36d1ec18670cae88d8b
SHA512d6ac5f99aaf3ecd7985d1d2bac8e04708758515cba1802175d85df050424763005b8443ec33f3c338e39029b42f3681a8733e30816483e65c5441d8457347b9d
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
408KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB