Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

7b271f5de5...2d.exe

windows10-1703-x64

10

7b271f5de5...2d.exe

windows7-x64

10

7b271f5de5...2d.exe

windows10-1703-x64

10

7b271f5de5...2d.exe

windows10-2004-x64

10

7b271f5de5...2d.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    288s
  • max time network
    301s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2024, 13:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe

  • Size

    7.2MB

  • MD5

    318b2f34fe665928280456b1d22c0390

  • SHA1

    12b169796c8974eef2907b0e0f856896063484ad

  • SHA256

    7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d

  • SHA512

    2a1a67016f7c183b7821df4518e0ca45c74232ac2638fe9ee8aca7781d883bbfca8ee955aa66810ae202e56138585b69b7ab3a43cbf9a07a90ad0bf8e69430c3

  • SSDEEP

    6144:rGnJDaCOoSEmkWeILer9bqKuFkB20VzcgcLIa:caCOfVkWeAeMHFkVV6LIa

Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Signatures

  • Detect Gurcu Stealer V3 payload 7 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe
    "C:\Users\Admin\AppData\Local\Temp\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe" &&START "" "C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2648
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:2688
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:2656
        • C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe
          "C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2096
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:3056
              • C:\Windows\system32\netsh.exe
                netsh wlan show profiles
                5⤵
                  PID:2636
                • C:\Windows\system32\findstr.exe
                  findstr /R /C:"[ ]:[ ]"
                  5⤵
                    PID:2872
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:816
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:1680
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show networks mode=bssid
                      5⤵
                        PID:2060
                      • C:\Windows\system32\findstr.exe
                        findstr "SSID BSSID Signal"
                        5⤵
                          PID:2248
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {74CECE97-5A59-4B5E-B834-614E56D9407A} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:844
                  • C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe
                    C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe
                    2⤵
                    • Executes dropped EXE
                    • Accesses Microsoft Outlook profiles
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • outlook_office_path
                    • outlook_win_path
                    PID:1724
                    • C:\Windows\system32\cmd.exe
                      "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2500
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        4⤵
                          PID:2936
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          4⤵
                            PID:2924
                          • C:\Windows\system32\findstr.exe
                            findstr /R /C:"[ ]:[ ]"
                            4⤵
                              PID:112
                          • C:\Windows\system32\cmd.exe
                            "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1020
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              4⤵
                                PID:2792
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show networks mode=bssid
                                4⤵
                                  PID:2808
                                • C:\Windows\system32\findstr.exe
                                  findstr "SSID BSSID Signal"
                                  4⤵
                                    PID:2788

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                              Filesize

                              68KB

                              MD5

                              29f65ba8e88c063813cc50a4ea544e93

                              SHA1

                              05a7040d5c127e68c25d81cc51271ffb8bef3568

                              SHA256

                              1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                              SHA512

                              e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                              Filesize

                              344B

                              MD5

                              2cc358b16881d7bef12d802c0854015a

                              SHA1

                              18c3224ad078909ee4ddae0071d5da35dfb894c8

                              SHA256

                              04dd1672043cbbd2280b876bc87ecadd979d0414441cc4de73e4fca197158644

                              SHA512

                              57d30e0fd6b59faa99c2799d6cc433e8a15f8b02416ee945a265014d880c045d29ded52fc0c88619d0948ca8347b178740e3fc896a22c878de594aa92ecf25b4

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                              Filesize

                              344B

                              MD5

                              2e1ab364ab2ee62776992624867fdf30

                              SHA1

                              f0be2a5e10fb42f096ba437b64f2c9e9b38758df

                              SHA256

                              b397e058653f8c18bfb3544e89340720ea45647dc37c63ee8bedfee6ac7b6aaf

                              SHA512

                              ce71d008506b4156cf408aa203f737833a03f9bb28758f9952180184e373a24aadc6da2600ecf0dbe8b45f8e17ac78cb44ea739cea374b996d68582515192de7

                              Download Submit

                            • C:\Users\Admin\AppData\Local\6pd9qgil4r\port.dat
                              Filesize

                              4B

                              MD5

                              c4bfbf68f5d8d0f8b9a0752ca08ea01d

                              SHA1

                              42e93171cf8b6e39ff11ad7a4f2025f238c6381e

                              SHA256

                              e8557282e35cc1c41b468ebbf01e770d9880bbb1b97fafb3e91ee7ec60affcbf

                              SHA512

                              cba38ece12e1834b7fbe3fdb4e01da1b53f44e5709b9abd4e9c8a30daa231f94299ec41019f9281ebd27e98a4630feda8edac8670c3244cc7baf66dade8c6286

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\TarB6BA.tmp
                              Filesize

                              177KB

                              MD5

                              435a9ac180383f9fa094131b173a2f7b

                              SHA1

                              76944ea657a9db94f9a4bef38f88c46ed4166983

                              SHA256

                              67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                              SHA512

                              1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\WindowsSecurity\7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d.exe
                              Filesize

                              7.2MB

                              MD5

                              318b2f34fe665928280456b1d22c0390

                              SHA1

                              12b169796c8974eef2907b0e0f856896063484ad

                              SHA256

                              7b271f5de5b2fbb7b2dada7b93ea925b199bbef2462f527409ae62249c1d102d

                              SHA512

                              2a1a67016f7c183b7821df4518e0ca45c74232ac2638fe9ee8aca7781d883bbfca8ee955aa66810ae202e56138585b69b7ab3a43cbf9a07a90ad0bf8e69430c3

                              Download Submit

                            • memory/1704-1-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

                              Filesize

                              9.9MB

                              Download

                            • memory/1704-5-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

                              Filesize

                              9.9MB

                              Download

                            • memory/1704-0-0x00000000000F0000-0x000000000012E000-memory.dmp

                              Filesize

                              248KB

                              Download

                            • memory/1704-2-0x000000001B1A0000-0x000000001B220000-memory.dmp

                              Filesize

                              512KB

                              Download

                            • memory/1724-122-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

                              Filesize

                              9.9MB

                              Download

                            • memory/1724-123-0x000000001A690000-0x000000001A710000-memory.dmp

                              Filesize

                              512KB

                              Download

                            • memory/1724-179-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

                              Filesize

                              9.9MB

                              Download

                            • memory/1724-180-0x000000001A690000-0x000000001A710000-memory.dmp

                              Filesize

                              512KB

                              Download

                            • memory/2096-11-0x000000001B500000-0x000000001B580000-memory.dmp

                              Filesize

                              512KB

                              Download

                            • memory/2096-9-0x00000000000E0000-0x000000000011E000-memory.dmp

                              Filesize

                              248KB

                              Download

                            • memory/2096-119-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

                              Filesize

                              9.9MB

                              Download

                            • memory/2096-120-0x000000001B500000-0x000000001B580000-memory.dmp

                              Filesize

                              512KB

                              Download

                            • memory/2096-10-0x000007FEF4D90000-0x000007FEF577C000-memory.dmp

                              Filesize

                              9.9MB

                              Download