Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    22/09/2023, 06:26

General

  • Target

    009029201_Alu Payment DUE Outstanding.exe

  • Size

    911KB

  • MD5

    6a796148a25bea3bec318ff96b9f6675

  • SHA1

    3ef1b848f0b21feb225430f2f8609c3b12ed1339

  • SHA256

    0ef8690ac5fbda00640852fe323d69dcc7df51d9a367070500d37529148a37df

  • SHA512

    482336dc1ad64e909951187427d4c62c1dbcfb807d08f0413e6e2134624ba9e82b17b6b8164a2785427b9d30993a48296d38869b5277d62e8cda2c817f6bffba

  • SSDEEP

    24576:+3jC+JA7QnoFGkqGsmzJqUfefRdxE/6vk:8m+7nooGsmzJqmepdi/6v

Score
10/10

Malware Config

Extracted

Family

darkcloud

C2

https://api.telegram.org/bot5637864859:AAHatMmLjO3i5zaPb5Ppy5_wDiRtKwQUbSU/sendMessage?chat_id=5990783030

Signatures

  • DarkCloud

    An information stealer written in Visual Basic.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\009029201_Alu Payment DUE Outstanding.exe
    "C:\Users\Admin\AppData\Local\Temp\009029201_Alu Payment DUE Outstanding.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dEraEFIkD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp93A8.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1292
    • C:\Users\Admin\AppData\Local\Temp\009029201_Alu Payment DUE Outstanding.exe
      "{path}"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp93A8.tmp

    Filesize

    1KB

    MD5

    1d3f6f5781e74f0d3dd8ec8fad67c4be

    SHA1

    66818ba6f1dd7ae96904f387f6f673697bd4df7b

    SHA256

    45188da6569d25a472f5bf9f95abc905159aba9ed3b036bdcc0fc826938770f8

    SHA512

    52448779613ad842e8fadb3d2e688e5f2016d95915039203a825e8802248207a46bf87e9bbd31cc3d66cdfafb0df42d815c5fb8cbeb62d470cdaac74069e4f39

  • memory/2808-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2808-15-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/2808-25-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/2808-21-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/2808-19-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/2808-11-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/2808-13-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/3028-2-0x00000000043E0000-0x0000000004420000-memory.dmp

    Filesize

    256KB

  • memory/3028-6-0x0000000005490000-0x0000000005542000-memory.dmp

    Filesize

    712KB

  • memory/3028-1-0x0000000074E30000-0x000000007551E000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-7-0x00000000051F0000-0x0000000005270000-memory.dmp

    Filesize

    512KB

  • memory/3028-0-0x00000000001F0000-0x00000000002DA000-memory.dmp

    Filesize

    936KB

  • memory/3028-5-0x00000000043E0000-0x0000000004420000-memory.dmp

    Filesize

    256KB

  • memory/3028-4-0x0000000074E30000-0x000000007551E000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-22-0x0000000074E30000-0x000000007551E000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-3-0x0000000000410000-0x000000000041C000-memory.dmp

    Filesize

    48KB