Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2024, 15:53

General

  • Target

    35b5b0cc100e0ba95f366d6a3b427823.exe

  • Size

    490KB

  • MD5

    35b5b0cc100e0ba95f366d6a3b427823

  • SHA1

    2845a8d906a0c93281c560de1e2e3d5a8ae2a546

  • SHA256

    2db46ad5e0370f7f9762fd2ed5ca32e2bfcb7d78c56df7240cd4ff05889dd4d0

  • SHA512

    29252fdfd992ec5d0d351d43bed65872f0a5637a1854fbe796aa37f9dfbba4e11d0ba2be8418c56a79a846100e96418c7ee7d8bc8ee1b489a5a8bd0ca073841d

  • SSDEEP

    12288:CTPh8TlBsPJ78hCWS0ok+jhXWuz/qMvp5h93Yure:zl870

Malware Config

Signatures

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35b5b0cc100e0ba95f366d6a3b427823.exe
    "C:\Users\Admin\AppData\Local\Temp\35b5b0cc100e0ba95f366d6a3b427823.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\35b5b0cc100e0ba95f366d6a3b427823.exe
      C:\Users\Admin\AppData\Local\Temp\35b5b0cc100e0ba95f366d6a3b427823.exe
      2⤵
      • Drops desktop.ini file(s)
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2212
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show profile
          4⤵
            PID:308
          • C:\Windows\SysWOW64\findstr.exe
            findstr All
            4⤵
              PID:764
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              4⤵
                PID:2052
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1624
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 864
              3⤵
              • Program crash
              PID:2728
        • C:\Windows\SysWOW64\netsh.exe
          netsh wlan show networks mode=bssid
          1⤵
            PID:2680
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            1⤵
              PID:2544

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

              Filesize

              65KB

              MD5

              ac05d27423a85adc1622c714f2cb6184

              SHA1

              b0fe2b1abddb97837ea0195be70ab2ff14d43198

              SHA256

              c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

              SHA512

              6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

              Filesize

              1KB

              MD5

              a266bb7dcc38a562631361bbf61dd11b

              SHA1

              3b1efd3a66ea28b16697394703a72ca340a05bd5

              SHA256

              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

              SHA512

              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              7982ff5f0d61ab2e90c280247f74ec4d

              SHA1

              b9a5854eff7b015becef992783e16fe893ea9beb

              SHA256

              e7a7017dc18768ea7a11975a64e099892f3b1d6ea6599c7d19b6ddced2b1c556

              SHA512

              3d40c80749057ccc444834f950f14d7c305cea1e11830620fb92ed12b5c5b6aedccb5da5e2ff21239cc704de6f221ed87d695a6d8f6ca21a04e6ba539a320c18

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

              Filesize

              242B

              MD5

              2b8f8208d63351c3c16a80b29ed43b8e

              SHA1

              18cddffa520c87189a49d726c6e11371ea33a0d7

              SHA256

              d1f1691b299bafc58c01a230ef16f722ada2881c985e113fddaa1f836e31d4c2

              SHA512

              f51a401bd323cd7f67f4c0ec94729e777bf7e47db9ffa6cf43d33aea2f9a32f5740bfcdb032f373b2628e5a0b7edec9f4aa03d024232c3571d4df42b02d70f6f

            • C:\Users\Admin\AppData\Local\Temp\Tar4E0D.tmp

              Filesize

              171KB

              MD5

              9c0c641c06238516f27941aa1166d427

              SHA1

              64cd549fb8cf014fcd9312aa7a5b023847b6c977

              SHA256

              4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

              SHA512

              936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

            • C:\Users\Admin\AppData\Local\c6913aa19b94d5c5a2ab587784a2ff7e\Admin@SCFGBRBT_en-US\Browsers\Firefox\Bookmarks.txt

              Filesize

              105B

              MD5

              2e9d094dda5cdc3ce6519f75943a4ff4

              SHA1

              5d989b4ac8b699781681fe75ed9ef98191a5096c

              SHA256

              c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

              SHA512

              d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

            • C:\Users\Admin\AppData\Local\c6913aa19b94d5c5a2ab587784a2ff7e\msgid.dat

              Filesize

              1B

              MD5

              cfcd208495d565ef66e7dff9f98764da

              SHA1

              b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

              SHA256

              5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

              SHA512

              31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

            • memory/1136-17-0x0000000074690000-0x0000000074D7E000-memory.dmp

              Filesize

              6.9MB

            • memory/1136-11-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/1136-8-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/1136-7-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/1136-5-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/1136-3-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/1136-18-0x0000000002310000-0x0000000002350000-memory.dmp

              Filesize

              256KB

            • memory/1136-208-0x0000000074690000-0x0000000074D7E000-memory.dmp

              Filesize

              6.9MB

            • memory/1136-87-0x0000000002310000-0x0000000002350000-memory.dmp

              Filesize

              256KB

            • memory/1136-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/1136-210-0x0000000002310000-0x0000000002350000-memory.dmp

              Filesize

              256KB

            • memory/1136-14-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/1136-16-0x0000000000400000-0x0000000000428000-memory.dmp

              Filesize

              160KB

            • memory/1136-209-0x0000000002310000-0x0000000002350000-memory.dmp

              Filesize

              256KB

            • memory/2188-0-0x0000000000CF0000-0x0000000000D70000-memory.dmp

              Filesize

              512KB

            • memory/2188-2-0x0000000004AC0000-0x0000000004B00000-memory.dmp

              Filesize

              256KB

            • memory/2188-13-0x0000000074690000-0x0000000074D7E000-memory.dmp

              Filesize

              6.9MB

            • memory/2188-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

              Filesize

              6.9MB