Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    275s
  • max time network
    283s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2024, 22:21

General

  • Target

    0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068.exe

  • Size

    455KB

  • MD5

    39f8e1c34c1a6e6aa1fa544a62f6153d

  • SHA1

    4ff01ce75ce3062f960ff31c86f94d88632fce5a

  • SHA256

    0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068

  • SHA512

    21512c4e99a7dbd3ed5d18733980e52c739304815f964f50c7e6b8ee205410e57bc8c56afa97cfe6c6dd7215cb6ab14c020d6cdbebbe69eef9318a2e90db01e9

  • SSDEEP

    6144:/kQovcEzShy9BhYyKVPJq/URCX68fELkHlVAwmN8HGPq1Mv4qb4/V:8QoUgSUAnRCL8YHLAWH9eAU4/V

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Detects Arechclient2 RAT 1 IoCs

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068.exe
    "C:\Users\Admin\AppData\Local\Temp\0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\u274.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u274.0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:3016
    • C:\Users\Admin\AppData\Local\Temp\u274.2\run.exe
      "C:\Users\Admin\AppData\Local\Temp\u274.2\run.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2456
    • C:\Users\Admin\AppData\Local\Temp\u274.3.exe
      "C:\Users\Admin\AppData\Local\Temp\u274.3.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:672
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\a156d2ee87eeb3012aacff4fcc5518f7fa0b2caa0b97ad5a5e46c2e4fdf8c5f4\e947697d6d4a4286ae1d5a12bcf7c7ba.tmp

    Filesize

    1KB

    MD5

    8ec95f4e3d2d87b78fd920034f6b24e1

    SHA1

    2b4d3adffa56b9d2f8d082277cf8118f3e18ad56

    SHA256

    1970c38ec1fdd49f806b60d95cb6263539e7914ece8592025ecf42117f9ddd9e

    SHA512

    c85b899b13789051ce81a5368012a0bf316eb495dcc4ac46213c97efcf28ffd98e02a5e75fe496ad785ae95766cee791ca46a585febf87fc6f237e592870d8bf

  • C:\Users\Admin\AppData\Local\Temp\U2741~1.ZIP

    Filesize

    1.6MB

    MD5

    9bb67e904ac371b5ffd143f8fb54e1e2

    SHA1

    58009e463133af8b89b59716fe255b118eca872c

    SHA256

    44afbc66f029be48db5d01678a0af7baf541e4a61d4b07391aa0470f0a961ded

    SHA512

    573c196dc87a1d3ea22b3ebdd2be1e4fbfbd3ea431694ec5e503f5cc6717b7d63a478c5c981ba5b467176aadd352c92f1d026b60a28b8ff76390af6903c1cdc0

  • C:\Users\Admin\AppData\Local\Temp\a5ae41f1

    Filesize

    1.4MB

    MD5

    6929c4252fba7851a0ca2d017b21cfef

    SHA1

    998954fac4a8645e69bee1080a360b84f6e08bcb

    SHA256

    6bf6c044615d73788c1eb5e4fc1244146c1e7eabb8070564f47d13d4f2fd30eb

    SHA512

    cf05943e02fb432f8848548c150bf157282eedc7bad211e9424cf78472871b276d68b82609e486c06a5993eea5d7c88225817889e93da6d44078bec4530c9f0a

  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

    Filesize

    2KB

    MD5

    f26f17dfad8ee11bcda8500612590e9b

    SHA1

    38e5c208a3eefa4bf89f7d39ead67e6565a5fc06

    SHA256

    e71b149a54e5b4271befc9e67a4843248568ebea6e6c0afc5c24ab486409c027

    SHA512

    e6a1c2f8fd47b4a7a62c3e5ccbbf62cc6556bdbf1824541c5e901f10080b3930cedff27507b98353f584fcb954dfd5eac6c46556970aeee183f3ce539e0b6004

  • C:\Users\Admin\AppData\Local\Temp\tmp9196.tmp

    Filesize

    20KB

    MD5

    c9ff7748d8fcef4cf84a5501e996a641

    SHA1

    02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

    SHA256

    4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

    SHA512

    d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

  • C:\Users\Admin\AppData\Local\Temp\u274.2\ASUS_WMI.dll

    Filesize

    224KB

    MD5

    3f109a02c8d642e8003a1188df40d861

    SHA1

    f723f38471b8872443aa9177eef12a96c02cc84a

    SHA256

    6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5

    SHA512

    023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da

  • C:\Users\Admin\AppData\Local\Temp\u274.2\ATKEX.dll

    Filesize

    84KB

    MD5

    e68562f63265e1a70881446b4b9dc455

    SHA1

    da16ef9367bde3ce892b1a0e33bc179d8acdceb3

    SHA256

    c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb

    SHA512

    6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674

  • C:\Users\Admin\AppData\Local\Temp\u274.2\AsIO.dll

    Filesize

    120KB

    MD5

    f383f6f4e764619bd19e319335d3ef2b

    SHA1

    99f287e49a15e495b4ead8e5589364a5f87b357e

    SHA256

    03951dfe05bf74c61568aed50b9d8ce5ecf0e0c2b8e73bc37e1a699ae7eebc9d

    SHA512

    6fa960a084f42e6de25b74782d205c48ca9329997fc2ae8db902bb653da5e878ed92ced6b37472248d5bdc820fc48080ae4fce41556c4b20a049e30bf93d6934

  • C:\Users\Admin\AppData\Local\Temp\u274.2\doubled.doc

    Filesize

    1.2MB

    MD5

    f344794dc910dc343f92ded2c6b5e0ab

    SHA1

    e5878518ce55ce5bd1890d5e04a82eb22d5a848a

    SHA256

    3cf94707697ce0141960b05a15cbd3c3b791196995b1d21c4ff6bfb59997e235

    SHA512

    ee00ad0c728c750b6c75001ba52df7ef367bebf1cbc01e2c9370dd42b1867b5347d5e68254f427dddde3214f2fae1341ab76c7faa3a4724e1d1d43fae97d3a58

  • C:\Users\Admin\AppData\Local\Temp\u274.2\protactinium.log

    Filesize

    84KB

    MD5

    a276acc3fd657d7665bd4ddce8fb9749

    SHA1

    c02642eec3f4e8b0314045ee95e0a15abd853ea8

    SHA256

    6565f36d224ff27d89ad39a0d87f851f64308834d86e8a7cd02e9e1ea44187c8

    SHA512

    178476d229ff011cb1f39048acae46b42a80b2ec209b283a8237604646b09224446c5bb3a690191c4fd58813611d7c06b4fb23699cd76ad020a5d0bf4d456d79

  • C:\Users\Admin\AppData\Local\Temp\u274.2\run.exe

    Filesize

    446KB

    MD5

    485008b43f0edceba0e0d3ca04bc1c1a

    SHA1

    55ae8f105af415bb763d1b87f6572f078052877c

    SHA256

    12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10

    SHA512

    402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1

  • \ProgramData\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • \ProgramData\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • \Users\Admin\AppData\Local\Temp\u274.0.exe

    Filesize

    274KB

    MD5

    fae96a12ae35c2243801206ca089798d

    SHA1

    52b8769b202701900f03c386623232ee23fb90d3

    SHA256

    1b32e30cfeea17e7f29f8c907c42cafc3a18da4306007b5c5bc38cb6bb4f1750

    SHA512

    7a3d2284145b98b8db779e1a941f48125fd3fee00dc147fb6a2c0ecf0840b9c52973930871182e402726878de2bfb0dd7e4d64396e4280700511e2ac81aa7abe

  • \Users\Admin\AppData\Local\Temp\u274.3.exe

    Filesize

    4.6MB

    MD5

    397926927bca55be4a77839b1c44de6e

    SHA1

    e10f3434ef3021c399dbba047832f02b3c898dbd

    SHA256

    4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

    SHA512

    cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

  • memory/672-288-0x0000000000400000-0x00000000008AD000-memory.dmp

    Filesize

    4.7MB

  • memory/824-164-0x0000000074160000-0x00000000742D4000-memory.dmp

    Filesize

    1.5MB

  • memory/824-155-0x00000000775A0000-0x0000000077749000-memory.dmp

    Filesize

    1.7MB

  • memory/824-154-0x0000000074160000-0x00000000742D4000-memory.dmp

    Filesize

    1.5MB

  • memory/1728-289-0x0000000000ED0000-0x00000000047C8000-memory.dmp

    Filesize

    57.0MB

  • memory/1728-300-0x000000001E070000-0x000000001E0D2000-memory.dmp

    Filesize

    392KB

  • memory/1728-313-0x000000001E620000-0x000000001E62C000-memory.dmp

    Filesize

    48KB

  • memory/1728-309-0x000000001E110000-0x000000001E11A000-memory.dmp

    Filesize

    40KB

  • memory/1728-310-0x000000001E600000-0x000000001E622000-memory.dmp

    Filesize

    136KB

  • memory/1728-307-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

    Filesize

    40KB

  • memory/1728-308-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

    Filesize

    40KB

  • memory/1728-305-0x0000000020070000-0x0000000020370000-memory.dmp

    Filesize

    3.0MB

  • memory/1728-301-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

    Filesize

    40KB

  • memory/1728-290-0x000000001EDA0000-0x000000001EEB0000-memory.dmp

    Filesize

    1.1MB

  • memory/1728-292-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

    Filesize

    48KB

  • memory/1728-293-0x0000000000600000-0x0000000000614000-memory.dmp

    Filesize

    80KB

  • memory/1728-291-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/1728-294-0x000000001DF50000-0x000000001DF74000-memory.dmp

    Filesize

    144KB

  • memory/1728-296-0x000000001E100000-0x000000001E10A000-memory.dmp

    Filesize

    40KB

  • memory/1728-297-0x000000001EC40000-0x000000001EC6A000-memory.dmp

    Filesize

    168KB

  • memory/1728-299-0x000000001F880000-0x000000001F8FA000-memory.dmp

    Filesize

    488KB

  • memory/1728-298-0x000000001F7D0000-0x000000001F882000-memory.dmp

    Filesize

    712KB

  • memory/2456-326-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2456-324-0x0000000072900000-0x0000000073962000-memory.dmp

    Filesize

    16.4MB

  • memory/2456-325-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2456-328-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2808-230-0x00000000775A0000-0x0000000077749000-memory.dmp

    Filesize

    1.7MB

  • memory/2808-322-0x0000000074160000-0x00000000742D4000-memory.dmp

    Filesize

    1.5MB

  • memory/2848-170-0x0000000000400000-0x0000000001A3C000-memory.dmp

    Filesize

    22.2MB

  • memory/2848-188-0x0000000000400000-0x0000000001A3C000-memory.dmp

    Filesize

    22.2MB

  • memory/2848-190-0x0000000001B40000-0x0000000001C40000-memory.dmp

    Filesize

    1024KB

  • memory/2848-189-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2848-3-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2848-2-0x0000000000230000-0x000000000029D000-memory.dmp

    Filesize

    436KB

  • memory/2848-1-0x0000000001B40000-0x0000000001C40000-memory.dmp

    Filesize

    1024KB

  • memory/3016-229-0x0000000000400000-0x0000000002B02000-memory.dmp

    Filesize

    39.0MB

  • memory/3016-327-0x0000000000400000-0x0000000002B02000-memory.dmp

    Filesize

    39.0MB

  • memory/3016-20-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/3016-348-0x0000000000400000-0x0000000002B02000-memory.dmp

    Filesize

    39.0MB