Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2023, 06:40

General

  • Target

    Payment Slip.exe

  • Size

    336KB

  • MD5

    66cc22ed167cdaef60b10efd54949ff6

  • SHA1

    bbe7a39f01333346c8e3bcfbf73e4c484a3bc2cd

  • SHA256

    78fbd42e5b8ac36090e1765cb86e573a4d8f2c3e1b6339c3e081343e74967943

  • SHA512

    57c4c110a59c104af9ddee66d75a62330d985d83d604f3131920449265a9e2f2b5aa36f34da1b8fb86fe3875c254e27bfb87f51f32bc699ec465db4d1786640e

  • SSDEEP

    6144:/Ya6D86Y0vp4i0viRcFiU+0/WHT22FtdJ9KGTV:/YpThvOi0OcFiUdeHa27dXV

Malware Config

Extracted

Family

darkcloud

Attributes

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Slip.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy765A.tmp\xixaugr.dll

    Filesize

    53KB

    MD5

    18fe03603fef1da9072e5a778fa2da79

    SHA1

    d7bbb199679adf7d837a6fc019bd36a37c77a57b

    SHA256

    9e7731d5cbdd2e9f9c3add54e43eda6a82d782288bf5e9f5a9388affb772e3e3

    SHA512

    7dc9b851dce0727b44a091f2aa4274578fb1b65b77096a92a894c6876b8e2fd19327cdf333793507b519dc5208b32c8fbbc3eea2555484cb6a1005afe1271281

  • memory/2440-75-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-63-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-65-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-67-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-70-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-71-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-72-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-73-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-85-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-74-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-78-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-77-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-76-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-79-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-80-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-81-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-82-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-83-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2440-84-0x0000000000400000-0x0000000000476000-memory.dmp

    Filesize

    472KB

  • memory/2744-61-0x0000000000090000-0x0000000000190000-memory.dmp

    Filesize

    1024KB