Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8a09826573...c1.exe

windows7-x64

10

8a09826573...c1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 16:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8a098265737317cd7bf7bbef762b81c1.exe

  • Size

    2.2MB

  • MD5

    8a098265737317cd7bf7bbef762b81c1

  • SHA1

    e1c206f8914af7b22b4cc0af74966723faefd1bd

  • SHA256

    26ef72d7170fa0aa8ffab8695637d465040d1e51a8ba03a22855d7abfb902fbe

  • SHA512

    1a66997af3559b58db357e021ccce53a5de87fa47c5fba4c175f930792b0c8b2ec43a67823df7112e9b662935bbc81b0f367912ab5d729ec076d8742df7a9d69

  • SSDEEP

    24576:kJKWsWCN4jTYnUg5cb4xBNJhzuVy5rlZvUvb9CxxPkkz8V5p80kd2pkP4ij/v7IT:kJ2W/oUr4DNzzXrT4kMVfzhGN7es/K

Score
10/10
44caliberevasionspywarestealertrojan

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/850985103400108043/qMVlcxRCEtOy4d0lLo-ckGGqIgWka8O5mwrGC7NwW7qRJs5beglorhRUk-uRy4jQ1Cbz

Signatures

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a098265737317cd7bf7bbef762b81c1.exe
    "C:\Users\Admin\AppData\Local\Temp\8a098265737317cd7bf7bbef762b81c1.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Users\Admin\AppData\Local\Temp\Insidious.exe
      "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Users\Admin\AppData\Local\Temp\Spy IDChanger (2).exe
      "C:\Users\Admin\AppData\Local\Temp\Spy IDChanger (2).exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\44\Process.txt
    Filesize

    373B

    MD5

    f4524a69b98e8c28be3a10f022c1ee2c

    SHA1

    82defa534be60612c77c5ec67ed867f007a86035

    SHA256

    5b82e3146a68ad694e3f485207609a3a04c86593da740b61c6032235affbd334

    SHA512

    1a43d9c022dca7fd503b6ee4621280a4768ef4b78c5506ae22114fd902eef5fd441057c94b32a75615b178173a184704d0605ffb738757b6a0c803fe99364e9f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Spy IDChanger (2).exe
    Filesize

    60KB

    MD5

    f18cf2c76c5e8283a9d81640b198e01b

    SHA1

    29d2b98d71a263ee319cc65109e7325604d203d0

    SHA256

    b54d12aafa616be9524995f8df0527848776c08432556c178667e1429744e34d

    SHA512

    9543bd395281d41c7fafc470812bb920cbd70b918c864b3b245451a2b679ab621401c4857c8da000f952ae73e3c3f084aaaf74a15dc91966caf7680b84f1da04

    Download Submit

  • \Users\Admin\AppData\Local\Temp\Insidious.exe
    Filesize

    274KB

    MD5

    cc0f9ce3587d6a0ee7390ccf8567b764

    SHA1

    0d6b82a85b3ccf11a01482832fcb28e8f97ed68c

    SHA256

    7ce1e233b1994f4db7ded9540bc77f86608a8fed62ed9f58a36aedb9be3723b8

    SHA512

    b56fe5774b378c5dc6c73f9807e07062286b20077cf6a2ba4328d40ae597c0896dd97f955571893fad9e2e88eecd8fb7ffee84261caaee0171cd33e04452e160

    Download Submit

  • memory/2088-5-0x0000000000930000-0x0000000000931000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2088-4-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2088-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2088-7-0x0000000000940000-0x0000000000941000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2088-0-0x0000000000400000-0x0000000000923000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2088-19-0x0000000000400000-0x0000000000923000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2088-3-0x0000000000400000-0x0000000000923000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2088-1-0x0000000077D90000-0x0000000077D92000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2732-20-0x0000000000A70000-0x0000000000ABA000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2732-21-0x000007FEF61E0000-0x000007FEF6BCC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2732-22-0x00000000009C0000-0x0000000000A40000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2732-71-0x000007FEF61E0000-0x000007FEF6BCC000-memory.dmp

    Filesize

    9.9MB

    Download