Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 13:36

General

  • Target

    1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681.exe

  • Size

    560KB

  • MD5

    0c84a5727488a29d79506aad7b9e8fca

  • SHA1

    71bb901c18f2c9cf8514e9bfb9c9462398ad30c6

  • SHA256

    1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681

  • SHA512

    82fecbd6eaa17ce089bdd851272ff254114b28e37c46cb565f05d5868fa956221a558c68482cc2fccd43dfdf4c2b2244e6801009b36f086b1e1718f78b9c5888

  • SSDEEP

    12288:1bQNl/WqCYWjgAXty1e6AhQn/rXuoW+sr6RfO12K8Q0:1bmbWjgktYnzvdKcI2K8Q0

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    mail.stpgig.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Stpgig#Login21
C2

https://scratchdreams.tk

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 2 IoCs
  • Deletes itself 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681.exe
    "C:\Users\Admin\AppData\Local\Temp\1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ffVsTPS.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ffVsTPS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB941.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2528
    • C:\Users\Admin\AppData\Local\Temp\1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681.exe
      C:\Users\Admin\AppData\Local\Temp\1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1e2754b3cdcf417cf8a396df60f61b3f75f10cc61d27807991882c5149e9c681.exe"
        3⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 3
          4⤵
            PID:576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpB941.tmp

      Filesize

      1KB

      MD5

      1e2b770dc6d6f8ed2bf826e1bae1b3ba

      SHA1

      cdf2ea5e6441d61d92441629fcbb80ede7775f48

      SHA256

      8c770c4e6699f356cf574af2722a44f5d8ecd44c1b461add59f6114442b3afd4

      SHA512

      4f321e863979d83f0a17adf5498b04d87e9c215b428004e838c7ff3ef006df35f576e5ea87ec01f9b45a71ee492dbad81fe77110f988c4b71f59e74250c01fa5

    • memory/1968-0-0x000000013F660000-0x000000013F6EC000-memory.dmp

      Filesize

      560KB

    • memory/1968-1-0x000007FEF51E0000-0x000007FEF5BCC000-memory.dmp

      Filesize

      9.9MB

    • memory/1968-2-0x000000001B530000-0x000000001B5B0000-memory.dmp

      Filesize

      512KB

    • memory/1968-3-0x00000000021D0000-0x00000000021EA000-memory.dmp

      Filesize

      104KB

    • memory/1968-4-0x0000000002350000-0x0000000002362000-memory.dmp

      Filesize

      72KB

    • memory/1968-5-0x0000000002360000-0x0000000002370000-memory.dmp

      Filesize

      64KB

    • memory/1968-6-0x000000001B5B0000-0x000000001B616000-memory.dmp

      Filesize

      408KB

    • memory/1968-11-0x000007FEF51E0000-0x000007FEF5BCC000-memory.dmp

      Filesize

      9.9MB

    • memory/1968-17-0x000000001B530000-0x000000001B5B0000-memory.dmp

      Filesize

      512KB

    • memory/1968-33-0x000007FEF51E0000-0x000007FEF5BCC000-memory.dmp

      Filesize

      9.9MB

    • memory/2432-20-0x0000000140000000-0x0000000140024000-memory.dmp

      Filesize

      144KB

    • memory/2432-19-0x0000000140000000-0x0000000140024000-memory.dmp

      Filesize

      144KB

    • memory/2432-22-0x0000000140000000-0x0000000140024000-memory.dmp

      Filesize

      144KB

    • memory/2432-38-0x000007FEF51E0000-0x000007FEF5BCC000-memory.dmp

      Filesize

      9.9MB

    • memory/2432-37-0x000000001BAC0000-0x000000001BB40000-memory.dmp

      Filesize

      512KB

    • memory/2432-29-0x0000000140000000-0x0000000140024000-memory.dmp

      Filesize

      144KB

    • memory/2432-34-0x000007FEF51E0000-0x000007FEF5BCC000-memory.dmp

      Filesize

      9.9MB

    • memory/2432-24-0x000007FFFFFDC000-0x000007FFFFFDD000-memory.dmp

      Filesize

      4KB

    • memory/2672-28-0x00000000025E0000-0x0000000002660000-memory.dmp

      Filesize

      512KB

    • memory/2672-21-0x0000000002460000-0x0000000002468000-memory.dmp

      Filesize

      32KB

    • memory/2672-18-0x000000001B350000-0x000000001B632000-memory.dmp

      Filesize

      2.9MB

    • memory/2672-31-0x000007FEECDC0000-0x000007FEED75D000-memory.dmp

      Filesize

      9.6MB

    • memory/2672-35-0x00000000025E0000-0x0000000002660000-memory.dmp

      Filesize

      512KB

    • memory/2672-23-0x000007FEECDC0000-0x000007FEED75D000-memory.dmp

      Filesize

      9.6MB

    • memory/2672-36-0x000007FEECDC0000-0x000007FEED75D000-memory.dmp

      Filesize

      9.6MB

    • memory/2672-26-0x00000000025E0000-0x0000000002660000-memory.dmp

      Filesize

      512KB

    • memory/2672-25-0x00000000025E0000-0x0000000002660000-memory.dmp

      Filesize

      512KB