Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 20:28

General

  • Target

    file.exe

  • Size

    3.0MB

  • MD5

    88d8a1aa36d48e28d506abe4fa3e7322

  • SHA1

    03385cdb977d1e7effbe5f9c1712b723778d3ea7

  • SHA256

    0d124edbaa3ae482812d236f4ed05b094085949a794d69b0bebc679b4a011720

  • SHA512

    3674f482ef11b359f0969476b0b3ca017689a8ba39b91bf99b8751d5f8cc5e8a1077a81cff9cdb268746f39000ab5976f3adb1166f9b34f9c32c3ffdc1a06491

  • SSDEEP

    12288:XNzcTCPYV/oVQ+mJkP5isjJyhKxE5n9g8FYE2gXqi:XNzcTUYV3J25iDl9VYE2Mqi

Malware Config

Extracted

Family

stealc

C2

http://94.156.8.100

Attributes
  • url_path

    /5dce321003e6a6b5.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Op Op.bat & Op.bat & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "wrsa.exe opssvc.exe"
        3⤵
          PID:1176
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3948
        • C:\Windows\SysWOW64\findstr.exe
          findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
          3⤵
            PID:964
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md 29023
            3⤵
              PID:2752
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c copy /b 29023\Answers.pif + Regarding + Devoted + Litigation + Quebec + Bird 29023\Answers.pif
              3⤵
                PID:3904
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b Tired + Theoretical 29023\x
                3⤵
                  PID:4748
                • C:\Users\Admin\AppData\Local\Temp\29023\Answers.pif
                  29023\Answers.pif 29023\x
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2704
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 5 127.0.0.1
                  3⤵
                  • Runs ping.exe
                  PID:4164

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mozglue.dll

              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            • C:\ProgramData\nss3.dll

              Filesize

              2.0MB

              MD5

              1cc453cdf74f31e4d913ff9c10acdde2

              SHA1

              6e85eae544d6e965f15fa5c39700fa7202f3aafe

              SHA256

              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

              SHA512

              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            • C:\Users\Admin\AppData\Local\Temp\29023\Answers.pif

              Filesize

              111KB

              MD5

              222c2ebd30142c1e5fba3343151f8bc2

              SHA1

              c9c25d4ecc91f5c8c108a4210949350034e05dd8

              SHA256

              992bd0249d8cbd2a124fae855a41e92b06d08941a72a22cda28662927363e6d7

              SHA512

              9516bd331957268987ac803c9b41b621c6497df6bc17ba731f437d816656936e30705191dfa11455868eb297ea7a2a408b2fc7bd7cf8191488c3cb0b8a943a38

            • C:\Users\Admin\AppData\Local\Temp\29023\Answers.pif

              Filesize

              872KB

              MD5

              6ee7ddebff0a2b78c7ac30f6e00d1d11

              SHA1

              f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2

              SHA256

              865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4

              SHA512

              57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

            • C:\Users\Admin\AppData\Local\Temp\29023\x

              Filesize

              452KB

              MD5

              7a6280fecb35049852f0621b2fe68056

              SHA1

              52061818e4cba5519ccd3df0c2b8f00a268b1dd8

              SHA256

              f45dad331d7325f61a639c35109c3dff0f143cf90df8bc9d0e1781cd1dfc95c5

              SHA512

              7e51018ae5f6b2c5baf5f5bba958bebbfc7bc312e8a9ce841034190fa59bb7ab453f31d4fc4e18ab6515e551da387708bf0afe86dff9ee1e1bdaf3b4ee3abd6c

            • C:\Users\Admin\AppData\Local\Temp\Bird

              Filesize

              120KB

              MD5

              836c07851339002f98303a5c891e4eac

              SHA1

              cc45751b8f91cdb1472356f2aaddd47febbaf727

              SHA256

              a978ac3f2032fdf4d049d96625f0e2b87aef3423833180639066026ee7868ed8

              SHA512

              3453d2f08142d28feef6fb0515b5651cd7ddfd28bfc027f136a7ace391b2670957211b1dee87b6350ce5ef764f9b924efac75a89372d7cbc4884ad61b7063fea

            • C:\Users\Admin\AppData\Local\Temp\Devoted

              Filesize

              293KB

              MD5

              c9f80abd4f16771bd3737db863e23dcb

              SHA1

              46ae0172a2b91b1d803f8b6c4467f5cc77ea14af

              SHA256

              93a6b75ddcce2cff5408143cf7401fbf72997b1c2328067af24b57d2c27dbe7f

              SHA512

              839a7a1566bfdf7b3745fb8da07920931f08ff94506be181a20949502341e3b639aa17761a83d1a5507ff6f13f9c2953475571c510726f785a0a128a9d016ebf

            • C:\Users\Admin\AppData\Local\Temp\Litigation

              Filesize

              120KB

              MD5

              5c6fdfbeb0c825491d3750f554c17d34

              SHA1

              d268ac6a38ebcedc44ec26cbed4b6e01d579a94f

              SHA256

              8fdaff9449b777736fb29f83c0b1487301edf35dc7587fa21deff33b53653f2c

              SHA512

              0166394fdd4546528e53053c4b98c3e3bb55d86e4c8ed16ae31159d14bd7c5118cfcee9f664342bd46e5e915ece9ad7c98dfee488edbe2afee18521dc8fc066f

            • C:\Users\Admin\AppData\Local\Temp\Op

              Filesize

              14KB

              MD5

              d580ec11b3e6507e19206ba4bf57c694

              SHA1

              b992c3641f6912a79070f28702a9962e8940ce00

              SHA256

              b12b66aa2cc0cf0751dd60b3eb561599eff3d18fbb355a5798671990ad631f09

              SHA512

              73f4dcce72a04db7380f9842fbe7047ba9cecaaf5efd7c19863806eba584ffe37df928e95dfbeeadc4c46b775e9ff57de293d5c8c88b3c3df5caf7a87b127606

            • C:\Users\Admin\AppData\Local\Temp\Quebec

              Filesize

              228KB

              MD5

              d39006f287c262cb1c3b967980eb486e

              SHA1

              b95d53eadee9e6dbae4a0cabe2142c95d6682d43

              SHA256

              cfc2640eb5a5540551eb0f98d2401b2aa1cf2f0832f08467b63c990b81e3e072

              SHA512

              e8e6260d250ee7ca2cc0de27f21f66591bc4070c70483caf6aee216aebf7b9529eb109ec829e2b771f0a9796305dce57b01e49e7b370082bb400313c25b5f184

            • C:\Users\Admin\AppData\Local\Temp\Regarding

              Filesize

              111KB

              MD5

              76e943c61037c4ddf03ec734829a59ee

              SHA1

              12a74a7d38b08e696feb23e355d478721dd428d0

              SHA256

              4bd083555dac351a8fc53221fedad1b4b86bdd098f499668ed508b336d42ec32

              SHA512

              e7a78675e3cd4b3463ec0da05fe842c9acfc6c377f0e61e69227d34da31102e99d89e393f8eb5f12752ec888d1cc1de052a38b6373d94d677053297b839c4190

            • C:\Users\Admin\AppData\Local\Temp\Theoretical

              Filesize

              203KB

              MD5

              6c881a609113c5e54ec4fa36f728e53f

              SHA1

              cbf09b946769746a5fe50fcc2e8faa9b24c22650

              SHA256

              195e339af3f18876f51bcfc561d3964fa4f713db0ad5d72a749a490df2e43c64

              SHA512

              d46408f17dbe79068a76b4cbae289dc9a365d7ce76991efced6813ca7c58cfe8b11bb55b759b775ad3c6ef3a4d059a7a995c131ecf1b1ae3243243f3eeea3661

            • C:\Users\Admin\AppData\Local\Temp\Tired

              Filesize

              249KB

              MD5

              5a63e5f4324ae966ef09547f48a158d9

              SHA1

              461cb15043282d8f12f1a042ed773ee9e008a7fd

              SHA256

              dd8e0644d19a193fcfdfc7dfa6f55e5e9dca7b38041f03727e730dc76bd6de83

              SHA512

              5474a325eaa8a65f7042a40bb89709fdc937b227ebb78e118ba3c52f5a85ec88a420ad8cfff41351bc54385e689be06e77631e65cc55a66ce3dc01803ff8b555

            • memory/2704-28-0x0000000004FF0000-0x000000000522B000-memory.dmp

              Filesize

              2.2MB

            • memory/2704-26-0x0000000004FF0000-0x000000000522B000-memory.dmp

              Filesize

              2.2MB

            • memory/2704-27-0x0000000004FF0000-0x000000000522B000-memory.dmp

              Filesize

              2.2MB

            • memory/2704-25-0x0000000004FF0000-0x000000000522B000-memory.dmp

              Filesize

              2.2MB

            • memory/2704-29-0x0000000004FF0000-0x000000000522B000-memory.dmp

              Filesize

              2.2MB

            • memory/2704-30-0x0000000004FF0000-0x000000000522B000-memory.dmp

              Filesize

              2.2MB

            • memory/2704-31-0x0000000061E00000-0x0000000061EF3000-memory.dmp

              Filesize

              972KB

            • memory/2704-24-0x0000000003E70000-0x0000000003E71000-memory.dmp

              Filesize

              4KB

            • memory/2704-23-0x0000000077611000-0x0000000077731000-memory.dmp

              Filesize

              1.1MB

            • memory/2704-101-0x0000000004FF0000-0x000000000522B000-memory.dmp

              Filesize

              2.2MB