Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
281s -
max time network
321s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
17689160da1deaf2aec240d16d3abcc3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
17689160da1deaf2aec240d16d3abcc3.exe
Resource
win10v2004-20231215-en
General
-
Target
17689160da1deaf2aec240d16d3abcc3.exe
-
Size
46KB
-
MD5
17689160da1deaf2aec240d16d3abcc3
-
SHA1
95fc071ca8ecd4fccae1b59f7ff41cebc7f95803
-
SHA256
ac21b05c452cd4a3276c3a101de808e175871879c5eaedfb312d5f45b47dd400
-
SHA512
a3fa90c2cf653c815f2c1dc92189aea26ba20f6e3ebfaa838bfccbcb73ed1a641626fd25c0bafaf5c286a7aa09eb0859757bc86fca36d0f7035456184a3c37fc
-
SSDEEP
768:gGprX8TA10xUkqnEmLrXDoTMJ3nYsWUW8JdfS2AG8Jx2fQnunU0KBzuXoLuGlgzV:0AGmkUEoDoTuFdfSLhcQnurKUfvJG8
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 17689160da1deaf2aec240d16d3abcc3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1912 set thread context of 2616 1912 17689160da1deaf2aec240d16d3abcc3.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2616 17689160da1deaf2aec240d16d3abcc3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2616 17689160da1deaf2aec240d16d3abcc3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2616 1912 17689160da1deaf2aec240d16d3abcc3.exe 27 PID 1912 wrote to memory of 2616 1912 17689160da1deaf2aec240d16d3abcc3.exe 27 PID 1912 wrote to memory of 2616 1912 17689160da1deaf2aec240d16d3abcc3.exe 27 PID 1912 wrote to memory of 2616 1912 17689160da1deaf2aec240d16d3abcc3.exe 27 PID 1912 wrote to memory of 2616 1912 17689160da1deaf2aec240d16d3abcc3.exe 27 PID 1912 wrote to memory of 2616 1912 17689160da1deaf2aec240d16d3abcc3.exe 27 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 17689160da1deaf2aec240d16d3abcc3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\17689160da1deaf2aec240d16d3abcc3.exe"C:\Users\Admin\AppData\Local\Temp\17689160da1deaf2aec240d16d3abcc3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\17689160da1deaf2aec240d16d3abcc3.exeC:\Users\Admin\AppData\Local\Temp\17689160da1deaf2aec240d16d3abcc3.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:2616
-