Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05/05/2023, 20:56
General
-
Target
RFQ21032023.exe
-
Size
1.5MB
-
MD5
26d46c2c07d584f1a04280f47182e909
-
SHA1
381ec91ba5c4206be19a10a1cb0d2328a9385d71
-
SHA256
295ebe6ba820bb813c6e9dd5526bf194a8da0268085ba0fc805f19c1ae3c6186
-
SHA512
3cd2e063ed27a84cfa2513e76a77f6ed8a7987ff42f1e5e9ab9400491b1cfc0b407945ca09ab1a839807ac850a44a0521aa5fa2f9a90c9bd2df1ee0eefc3c8c0
-
SSDEEP
24576:D1fkORzjCc1R7CIPVQ/NcnBZuSAszPeo28pW4NiocXtWLezho6OrHRYfDz:Dabc7nyNgqSHzPj3zDYt8EhuWf
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ21032023.exe"C:\Users\Admin\AppData\Local\Temp\RFQ21032023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ21032023.exe"C:\Users\Admin\AppData\Local\Temp\RFQ21032023.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5fc241a0d7e4a11ad465a82faa956b2e9
SHA19b04e592785497a10862b286e4337d3e19237c84
SHA2563bfa48445cf30f8b45b24d1ca8370d4be4ab86de65b91188f27fb439f13254dc
SHA512d24c4c6ea0d32dec04f83611f19e9e94fdf84fce3a7fdc3f620d6a300d0905c1492b4c777522bad1cab81e3a39d59587625d46102963171f337f226e7e70a469
-
Filesize
1.4MB
MD5f9fc68239b3ba980f1e1ae5f44d42004
SHA10cd3d41a2d889fec46119b484a8cb10bac1b0a7a
SHA256b5bd99999c652a37d38a245dd27889a2b8b32a5cf59ee46124b018d6a25bcf65
SHA51250b9841295aa3a5306cf6c6ec1ee2e143d91cf85dbb1d0e8cf779be8793cbd5856f2b1db9ba7f9ee5f688c1b0971cdc4cf93959d5adeb81c433a8805fecf599f
-
Filesize
1.5MB
MD55ff37dc9a43b3bbc806cf260eeb0d3dd
SHA1142e6f4cd10d95cbda3bdd20ac7ef58b9ec6be0b
SHA256cfe26cc7416771eab3783e5c72c7a068ec532afc2805bc89a13e6de84e6f9349
SHA5123add0cc0dd93b130702fe495e96e212602cf181a1eb9e9878d3e2f38dca4caa7623518248aaf881a42aedef22b19411065e2d5e796868cf60fd10c9e0a72bebc
-
Filesize
2.1MB
MD566684322898d90007e07970ed291c6d1
SHA18896dc7354ed2d0f92d3c1eeb41d591e8da0eda8
SHA25636ac18afd8b9ae7b7cfa8a7f550afafd39f920d4b6a24c9499ec76367bf299fe
SHA51297098a5fbf4dc8150a29447e45b97bead9d65641b11e50bf887065e189934024d73503f3496fc7874a128552cd817753087e54a22b2fcc097f7cac3a7f4edfea
-
Filesize
1.2MB
MD50149e6ba23b3048b3e7c58bf15012f92
SHA1f8e4d3c76c22942298062955a2ec3ee653eb8d90
SHA25604690c7d9eec6301e04634b3b319d3fc15d4f52bbfeabce57134087b6c9eef57
SHA5121e7546267cb46e310b2c65e11a2fb7e0c819ef6ef46335ae30a282948bccab6d27f67d746e68481faff6cc4e6956ffec89b43d456e8730a99541a2532b1ecee2
-
Filesize
1.7MB
MD556a742c9ed12a0eeddb3e48eef59af45
SHA1a607ca2ee6d46fa494f12dff1db7734c9b27ee67
SHA256c4295f645563e827896e5705891e18834b5fe21f76478e7a66c9f1731004e759
SHA512bfca913610db0af6470db3d281af254027273dd5b2686c96735ad4dc1876ce459459b37d8c7595455313a20a2b5df4c2627a251e04e476e416d9e73f5aac9602
-
Filesize
1.3MB
MD50b4b02ecfcb297d1713d7dbb01f98d3a
SHA19f7a5aabc292e501308a574f8962b998e3861b30
SHA2568974a6ee30092da9506afdea1c69491931c0b4806ea96c83fbf3433fd5f412a7
SHA512f030b387e9349a1f2e5902f90b285a17cc771553be77202add19db4ee484700b0804bcfaa3594c1864d9d0045bb93fc823dd2c0e4f218816c3184da61955fa77
-
Filesize
1.2MB
MD5e02fe33cdc43947152285ca466ab8f69
SHA1edcca72a97cebce276881957c82e626cf454ac26
SHA2568289d9e413567f16aa4bcf90ffe890e8c7fe01202c8a2f2874c4531fd1841209
SHA512b869abe0fcf8ffb6b9a174a28283f63943408536204574f0d9111fe0a5489f6ed948033006b99d9f8b8735c5fa8450f6d7a9dc916537e609edc31f5b76c6be47
-
Filesize
1.2MB
MD5ccf4e26b93dbc1fcfaa0554544118464
SHA1564f9413dd0522765d46f3f3aaf5b628a5c506da
SHA2564f6115be234b8d40de2993226d5082d8cb34833fcbb7eefbeca377b6d43e56ac
SHA512fd486ac82d80c73575a1e6097ae8373200a8b3fa6545ac9702a6025d781b57fb3b10ef75c1bd61499248f3e10c06c78e6cb25ef43af053d629d079d23d49dbd1
-
Filesize
1.6MB
MD58ff767bedda64e1a5ac37e1003434443
SHA142eabfb3b9e4744b7628af33232f64dd1e29327b
SHA2563248878cd72fe2aa9acc2ab3e0551ddd60e274ddde8222cf03f737cfa4386c2f
SHA512907e6eafd34229d2d9b71da7550cbccd3e2aa2cbcb2561ee2a80ebf1f5ec45a3ab9899de93fff5ac23485a665f7328e5f776978ebfbbb6363dcc9962adb8a991
-
Filesize
1.6MB
MD58ff767bedda64e1a5ac37e1003434443
SHA142eabfb3b9e4744b7628af33232f64dd1e29327b
SHA2563248878cd72fe2aa9acc2ab3e0551ddd60e274ddde8222cf03f737cfa4386c2f
SHA512907e6eafd34229d2d9b71da7550cbccd3e2aa2cbcb2561ee2a80ebf1f5ec45a3ab9899de93fff5ac23485a665f7328e5f776978ebfbbb6363dcc9962adb8a991
-
Filesize
1.3MB
MD57295678ba0060ad643901447fe56ab1b
SHA13e27a4a6a67c401b34b56bb6d9de9c601d365673
SHA2563bae9a5d48d5f5f397276c90165513a7443b079b3761eb5c4cb9aa801a98f13e
SHA51249cdc6aa775f5184e08f47ba707a4794b7990ac652fb8ae426a69ff7a7f0b0895e3eab945ee350c46992a06b803b4a9adb82b146370b456c61d09f6bd7cc5f47
-
Filesize
1.4MB
MD5dc63ca410a1985d3b6852be64d907e4a
SHA14bbde2cb0ff83f10fe218a338a512b4e432d43b6
SHA256bfb8b0cd94656dc001b82804bd48f2f767ae7967172802742e324f4581f83632
SHA512d62d8b85145f050b94ea4da99893675ecd096c94db8d751fb1fe0fe525adb3bc532727f3400dbc3b6aa033bfa6b5d503ab4ef7e713eb442263248570762ba7ff
-
Filesize
1.8MB
MD51149d1f8fc06108f243d77d801a60a82
SHA1f0d8e0420c097b909fc61aee417ee96f5592defe
SHA2565569b35c194ffe77a09d62d7f6ff5334c7ae66208425abb0d5c580added09a65
SHA512b88e046093c92feb63e4c97c8c3d435b0a407c27a137a072abc7c81b6dbde971493758316b5f4b3a4583548b8649b1cb34bacda4b0292a989323cb160761dacc
-
Filesize
1.4MB
MD514eeca90e9a5a826f54343b8c3e01d8d
SHA1cf7fa85db0b8016cb7edeb8037f5bc04ff937bbd
SHA25635d8cd5a4f7350dec8cef22d725a1c9258e510d4b135c657786501a38d5cae5a
SHA512fad7b158f152d374e1bb597dba3f5e4089915ab7b72511c5d89e325606df933c9849c03157154c6ccb946e6ba185adf095ba14edd3eaafeee29318dc743640a0
-
Filesize
1.5MB
MD5ddf3b071f90cf5dc3e7131706fb36828
SHA177ecf65cbb2e3d2137aca3b9befb7449a3858144
SHA2568e970bbc0fd07e1e2a3ede5fb8b77e95cfd74d871e1a56214fbb4c4d574f8fb0
SHA51283260c44b88205efc07d0fb188f0bc90c69b71008b67c0bed087b811c6b1a0059eff5633623e820914b174bbc2bf40f4e0fc4edb0d208f86c2a8841c083bead8
-
Filesize
2.0MB
MD583fd76ff77b45d9b7f03adefbd127a34
SHA137616ceca85ea1d52d7cf0e388d023bbf575c163
SHA2562f9c3af4c8f431eac6a9a663ecb65ba048a3751c70612ded0370d149d3a0fc36
SHA5125bf8df8b939b68432c2a1120995dc37c10ca430b83f440581f2ebec768313e47859b8bf4e422ae83ee86d8a17116c3cf02cec8f05448162935a07ddc4492f7eb
-
Filesize
1.3MB
MD5f8dd779fa3acaf7e56cbb0c30ab9c4b8
SHA14e890f9da5f051385ea817f3b4cd47cbd91fdd2b
SHA25605b528faf266807159ff4b839231145077f13a2400df0aba55382cb790acd63a
SHA512eab6a751b5545a7baffd2b72b51bfe6d423696c68af34164962bded0ce48093b4dafad8991a67f85b165e61743e247ff241ba7443e295128393544042939b90b
-
Filesize
1.4MB
MD5bedb367212ee48f6524d5a7228bd6ef5
SHA12d07b5bee05316e1735d09988b826d056fdb9169
SHA256f96f45bc064abb276d9a70e6785ded3ad473e0a34317a973ec8e64cc7e6e1947
SHA5128a5cdf31272dd8714886c1d1d926b7a4f19768254fbe6ae1466654767fed37313992913fed029dee90e2e1d8b7679cb8fd0a230133bbe9968bb5f2aea2e99623
-
Filesize
1.2MB
MD5d3d322a7ce1ea40ef06fccf6b429ae84
SHA1f652143cc6884d3700514c20d65137e9fcc1bce1
SHA2567587cbfc7503dc8eaaac17212b696dd07fc3fefbb219c0bfba47837657caa859
SHA512e7f71d906e08506966658bd956d83c53bb83306d101e5ad05bfbc73bac47b13df09b36b7a91193838ab85e51cdfaf09812a98e3f94cd0bcb594359e9d86cbac4
-
Filesize
1.3MB
MD5e049149171a0ec5d2d4fb32ea5ffe728
SHA1cc9d48cfbaa887b443c6d75c17b7633a394eb59a
SHA2569a27127f9e89d5b70c64f0584462fa86f5df3feaecb1451f0638ccafca3f8923
SHA51237dabd98d714f136a114789db522ec3f0eebcc81e9698f86264d136956468b0d86003e6a0c3412d21d6707be0a9a62e2d13946c6176c1cd42502149e7205857b
-
Filesize
1.4MB
MD5438c4b50e000f1ee18776a0c8fd094b2
SHA14bc9f95bbe920433b849807e68b948b94de76841
SHA2560cdc3209b28e4994968ff679128032a0a49277803d32d8c38b3efc9a286dc395
SHA512190baf31755bdaf385554edf1f0f7ffc02df7a8a8c105d5ac996528ebb65ed0f37b1cff0d8a6297aeb8f3c1c1c8c191696b4bd07988f18d68ec16495670379f3
-
Filesize
2.1MB
MD57809f10f51b6bba19ba719e27208c3fd
SHA1fec32510085b21dea6d660c5391cf3b94a93a9dc
SHA256e1ea47c7613462aed1aca029246d49f996c76b00627e0788e489e3479d86f9fc
SHA5125b8448babf0ca7d621d012c9fa4402e59252a1a72a349bc9c010308995ee8b7cf31ba8177bc07ede3d50d28820a1c2f59844ace516a6897fb46d9a4b8077ac90
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
1.5MB
-
Filesize
5.6MB
-
Filesize
584KB