Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
AO XIANG FZCO Order.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AO XIANG FZCO Order.exe
Resource
win10v2004-20231215-en
General
-
Target
AO XIANG FZCO Order.exe
-
Size
824KB
-
MD5
6abf9774f4de80024cde72bd2200834c
-
SHA1
71b97fad458bb9a92b50bef5581969dff2dea71f
-
SHA256
54e6afb0e1d73c40ef7469640af6788fe46dfff38ac239ce66ba1fc9acbc788b
-
SHA512
fcf8e1bfa3868f0854436ba4b7c507c6b572a9e8cfe974ca654d6d744319ebd90091dba016a87427fe31b0272ce090a46554bb525eb03e553af431ddbc0fa327
-
SSDEEP
12288:fhsc0NQMU2IFLmtAodzVOdQdoyRYOrcritRdhUHlPdB6VeVQbW:ff8VGLmeoXOSdjRsutRdhUHpdgV7
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/1212-9-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1212-10-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1212-13-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1212-16-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1212-18-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1104 set thread context of 1212 1104 AO XIANG FZCO Order.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1212 RegAsm.exe 1212 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1212 RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 PID 1104 wrote to memory of 1212 1104 AO XIANG FZCO Order.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AO XIANG FZCO Order.exe"C:\Users\Admin\AppData\Local\Temp\AO XIANG FZCO Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1212
-