Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
11/05/2023, 18:50
General
-
Target
Purchaseorder3500354689.exe
-
Size
1.4MB
-
MD5
54449cb838ba6a7de0d11f73de31c1af
-
SHA1
4fa134aaab1517fc86d77de166e8cb5dc65943df
-
SHA256
2062e48bd178d835beb3c39a878ea0da87aae5a4a34e3322a12bc3e9e96bf52d
-
SHA512
d9177818bf33a55fda1a4dadd98db20c8f72bea1ee3d43d707ef3ddaaed7af944cc97dfb14d649f916573f201730d6bd39d51506ae314cb38882f59d7be19bc4
-
SSDEEP
24576:KRmht8BU5wGMUq6HxSzB793rWyxLV08a5XwE7uWhDVzeWhWGAUlCwUY/l:3l5MUqF99TxLG8aJ3lZLeUlv/l
Malware Config
Extracted
blustealer
https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchaseorder3500354689.exe"C:\Users\Admin\AppData\Local\Temp\Purchaseorder3500354689.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchaseorder3500354689.exe"C:\Users\Admin\AppData\Local\Temp\Purchaseorder3500354689.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5368e8445e0e37c91012ab407a08b4665
SHA1e261d90c1517eafbd7ab5eb86c66df237ee3cf09
SHA256185e34cacf4a68cfa43a1ea0c9b487ee7caebb09baefa68ee251a5b140d5746f
SHA512aae4e972dc0cba4b269bbc050075cda2f53fcd3b2ff5ed94ef2eab36e0e04c582bcd308b3a0469acb1ba16cf81d820ec43eb1d328ec14560819edbfa9bda3e33
-
Filesize
1.4MB
MD5fbd8463205cc160722bca198d2f55c72
SHA1acafe5502f532c24d772e5310d87407e7550bb59
SHA256f1797c5450d9400bc823ea32d067fcb73f18f451ac765d28e1e1834766730c62
SHA512b06b37bde4e6e7da8def96b8800a397df8961252cf11d586df4655a79f6e82633f026d7ff224076149cbd9e741967230b6931c0a338e9b8e0ea0aad9fbc6a078
-
Filesize
1.5MB
MD50cf1b7d68fe2fb22d7169a920ff4cb0e
SHA1f543802673f8616728451cbf8729b5afbcd63fc5
SHA25667d4bace53ccc1d153ee13f6433488d55dd7a3746610a1d6d143a0bddc2fa275
SHA5124680266053105126462cd4338263de9812f94d1cfee8df82c7e1854f6235ac03789b473c477c7f38bebd3b73cbf43690b1e38c06849206668d6b49eeecf15a07
-
Filesize
2.1MB
MD5c72585ace4a5ef71d23218be6ac1954a
SHA1a979fc035870849d8049e429b4b47dd76bae8a5d
SHA256ceb4cd6278f38153b70744fa5a706c85982b3e89300a3fc9b32fc45304648a3c
SHA5121a9c7047c20e43d7853d58e7f4e42ab798fcfd7b08bd3ba8bd217d773523651e795559a426475e16e1410c28ea4419d9380219e52a73772678f4a33a0c59f2fc
-
Filesize
1.2MB
MD5e6a6e77485e7d7c06e5cbd2d047fa865
SHA142b669c2f956767e9ef561b6199488787d741731
SHA2561cc87d31e5d0a3397a40883653f818c62108be009a26cb09ebaa4dd55829c979
SHA5122be09d07f0f31c88ad02db97c8aafa027ca97bb62bf3c081aadb2ceeff98c8300550030c5fe89aa4ef8cfff571a3a9c5bd2fdf3e05a615832bd50a473f9be3e1
-
Filesize
1.7MB
MD51e6169baf16c19bea66cb74fcc74e946
SHA1101f6be50fd316099a11a22808f9e0b9746b5c93
SHA256eedc498630920253508e82879766dcdb13d81d22d607c440f705deafcd23029d
SHA51229110fabeebb2913cc228b3d3b33571df19d89cca033dacb81ef8838c73b3bcd44ed8b6be1327865864dceef900571fb663c683a0312aeac2ccad51077637e00
-
Filesize
1.3MB
MD5bc3a108eb0a6ff16574e2791108e7d00
SHA1bb788779f8d5c9e2a075fcc5a09ed76f89e8c129
SHA256792ec73101d7edf63543594c7ad83fd5b1bb0e252e6177bc2f266942e1ffbd10
SHA5124ea21f7155b8e72ae723fadacf4c3a3f970c1ee87e8a6fc30fb3d8e93319030924788f61cb6e7f6fc6e99863f03a586cc2cc409856b87696316f2a82602e07f2
-
Filesize
1.2MB
MD58050f640679b856ef007af6fa01d3abc
SHA19dfd4128b4869d858a3f7d80e54d20e4b0a1d3ea
SHA256ca396447de3f73d937f95340629b466c625e373b6e8916ba8947f3958036fdc9
SHA512fd1114abeae485fc9ab7c8f919b0b8483a70f7ed1ee78ea8d96ca6c2d35b67e5c7bbbd4b1a324b9df5c5f21d2310006f846d48e66ec3d2b3766e99be9e3e6614
-
Filesize
1.2MB
MD5ddba3228700bed3a6a58f7fb7ec2ef5d
SHA1d2d62fcf9b13d664ce86b954737aec1bfd96edc2
SHA256907a969e9fae59231c905289b94490417017dd00f1fa6c468a885c2e4b6546d6
SHA512eab04055822e877c4c2ccc5df6918bb0078c0ed22d31c21958b832e1945023f695cce072f010b4b1159816618d0979c86db0901b55a804961c65085bcb5a5d6d
-
Filesize
1.6MB
MD5dc503f21a343ea5c5732c41d0c94737c
SHA164f638caff1bb4195957f3581ffe231dad2a88fb
SHA256d2327e8b7ab0108cba5563db3765ff720f7cc37837441611ecd075d24152059c
SHA512fbe0d2ab30d2d41eee49f3fbbf8fd19b23ee70770c315a70ccce3991f107a18e4c394181eacbe0539e631831cbbe5a9c9f86f686f513dc097b9369e23f90d6b8
-
Filesize
1.6MB
MD5dc503f21a343ea5c5732c41d0c94737c
SHA164f638caff1bb4195957f3581ffe231dad2a88fb
SHA256d2327e8b7ab0108cba5563db3765ff720f7cc37837441611ecd075d24152059c
SHA512fbe0d2ab30d2d41eee49f3fbbf8fd19b23ee70770c315a70ccce3991f107a18e4c394181eacbe0539e631831cbbe5a9c9f86f686f513dc097b9369e23f90d6b8
-
Filesize
1.3MB
MD532db7fec77d58c47bd9f91d8c98688cc
SHA1ffae1c36d7ed2205b21a80c5423dac5ea1482d8e
SHA256656e4df7d8c92823480411a8f24252cda1c115045d733d68cbd02a17dcff64a2
SHA512cc1b1ab509761b3ca9be2278e8e521bcfd7730e8fc46c8321de8a90cc72fd9e78e6f8e162fd9205a5757c46231fefeb4254677c4997f8f2730510f5c820315ef
-
Filesize
1.4MB
MD5553433ed2789565832301cfe17165552
SHA11602abb28cd9252f24b2088c430747614d097824
SHA2567b756e60dc96a3b326c8d23c7de8ceacb1cff00fbba26b4e3880d80378904ddd
SHA512726f089ccb20c11c1d2d89b614fff820c258a966b0a615b2107a2afb1d47777c3ffa03843c193eb99a9fb659931a7637bcce89a4487c1588a9a51733e580283a
-
Filesize
1.8MB
MD5b53d3c16c13c4a664b9e15bd92a9c25a
SHA188f1ad0154f64eeb5d9a20d9bb0fa14bec026948
SHA256395fb8e0ae90d39415ca2c6d52edcf2ae4fee7a43122dba86ab597828e60ca1b
SHA5124d9add9f00c717331a5dd4a89eba9fed02817e96dec91a8e72898421f7533d1681ec53475689b01baf42a743b02f42b7354a507163430ceee681417bf99a615d
-
Filesize
1.4MB
MD541e73f6f43d31b4f4ec0401a74006c3f
SHA1ddfa4b582e2f4102b8db0dd50c053f88738659ea
SHA256aaf523303ce05b4ed66c4133e0bc288c4cbca46e5e2937f9778e2adeb039a74a
SHA512653fd0e1bfd807595ac8b122bb6be8466a532dd9fcaa80a1facb54387a4cd5b0e74346739da0d52c68a113e1e28a9103e7c2d14a26bb6604cd7011e372d36e94
-
Filesize
1.5MB
MD506123c7aefe11920e6f8d02c731ef8e6
SHA14ef5348489b3e439974d886cb880d5c7de97a206
SHA2568083c0bbcf8983e727b70bbcb9fa1db01c233fd6ad7a15b4b3219739c90cb9fb
SHA512038e4f89d831e08f1ef15c9cac9ae07cc98cdf169eb1dd177e54a300f3c96ecf6a71750801ea47bd164455cbf6a6158aeab514195479a5723f7b49a0285fd5a5
-
Filesize
2.0MB
MD5ca91674ccb25a4cbbaae19c31cdc2f9b
SHA10b7e00cd04adefe8021cf7744c00cec5246b1301
SHA256c23d9543c34c515e345a62af51b21fed1e5bb884f30b82f2c917fe8d804cd577
SHA51262e0aa6e5a7d77dcb6940bd346d2ab15337acbb4e32303d6c7b74aa1827a909ce1f72c423664f515eae383895a16b80d1c4cc9151cf6a83867ad5603acbccb36
-
Filesize
1.3MB
MD5e9b10cfdb139819c68e06de851add5ba
SHA1926e0c330d2c60d81ccbda612aa33bda1de45ffa
SHA2569e56286bb6274fc193a7803cc244624399e7b8427696ad82ea4014d0466f814b
SHA512c2f90cc217151e09b0a8cba1b78280a2157a523d37801ad01d896f4d6458941a14db8611f70465276d2588b5191164f757c2f12286348ad52e7ac72763f23b93
-
Filesize
1.4MB
MD500416223f3190d2386e390c4252a2635
SHA1954122ce13790eeaf98d56dd01a04b7e64f8f334
SHA256352f76ebc92c9f2ba84e71e9b3688ad4fcab1eaac7af4159450127104f223799
SHA512266e4c7c4e1d9e980b980711076ef860b43af9ceacedd54870c657f9fd5275aaa6a73637565f42a0f199c4380f6dc74d1220aa85c805d9f90ab5e4641db09ccf
-
Filesize
1.2MB
MD519442bce721d70e46102147765727666
SHA19c476432a8ba68d2feec1637fae89bf3b22f308a
SHA256c129a2c81b44b29ad1f5558fcce7bba7b872d892c4b7a27c95c2254babb0814c
SHA512d99fba92835654d5e0aba705d123822175caa79ed562c96488296805979386e6dfb50f9561d650f280e6fbf08c4a81ea5754cda9d2ee4f8bbd9a37333932bd42
-
Filesize
1.3MB
MD5b6b9a5d4f37ec33f490f588d7b6d4af7
SHA1a917ac352b2b49e261a104bfd425c90fcd5e892e
SHA256190a533d091cff83b51a3f79c5f184f4bd2d88378b819a27f7eb5664c499f8af
SHA512483425a4fbf7ef4c0f12225cbf11c7de9d74fee2bd2eabcb29cfbd8a773fe4356e970390947224c9a59c63e06c401258c4193538a81b6a4779dd3561da87dd51
-
Filesize
1.4MB
MD53697d79566edff014937a226109d52d3
SHA1ff19305aef25c089f227df5271dea694b7f3e299
SHA256cf870aff83d837b97ab5204c66ee7a46202e6151fef1d935ffcb607bde1c1c8a
SHA5125aad88ae42bf7c2e138d5c037ea75a4c325e43a4add66f4fe8afbe7f2e44e572b71b27b045d0ad25bb0ebb136330eebedc1f0b7c09142b06476eaeecc4e71e25
-
Filesize
2.1MB
MD52d01104d89474a9221931f266050b56d
SHA1e56de0e8692f49c856308a47fae2e7cd16df7c2b
SHA25634a36a32a54c660d83cc91cde0c66847d85de7f4a8e672567ffa1a5d56f23007
SHA512c57c0479041f7ed8c28ec5cac79975d95f1d2011bed19556e0395ce4687d957118c92f6b2c2f8a851095807a7daad2c9688b6b93956157d320771b4c783254e1
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
2.2MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB