Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    292s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/05/2024, 22:21

General

  • Target

    0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068.exe

  • Size

    455KB

  • MD5

    39f8e1c34c1a6e6aa1fa544a62f6153d

  • SHA1

    4ff01ce75ce3062f960ff31c86f94d88632fce5a

  • SHA256

    0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068

  • SHA512

    21512c4e99a7dbd3ed5d18733980e52c739304815f964f50c7e6b8ee205410e57bc8c56afa97cfe6c6dd7215cb6ab14c020d6cdbebbe69eef9318a2e90db01e9

  • SSDEEP

    6144:/kQovcEzShy9BhYyKVPJq/URCX68fELkHlVAwmN8HGPq1Mv4qb4/V:8QoUgSUAnRCL8YHLAWH9eAU4/V

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Detects Arechclient2 RAT 1 IoCs

    Arechclient2.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068.exe
    "C:\Users\Admin\AppData\Local\Temp\0ffd98ee730d075f964045eb2538fb640a816b9db9c20fba0b9a66fb52a7c068.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Users\Admin\AppData\Local\Temp\u154.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u154.0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:3724
    • C:\Users\Admin\AppData\Local\Temp\u154.2\run.exe
      "C:\Users\Admin\AppData\Local\Temp\u154.2\run.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:868
    • C:\Users\Admin\AppData\Local\Temp\u154.3.exe
      "C:\Users\Admin\AppData\Local\Temp\u154.3.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Are.docx

    Filesize

    11KB

    MD5

    a33e5b189842c5867f46566bdbf7a095

    SHA1

    e1c06359f6a76da90d19e8fd95e79c832edb3196

    SHA256

    5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

    SHA512

    f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

  • C:\ProgramData\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • C:\Users\Admin\AppData\Local\Temp\e2b1fc0d

    Filesize

    1.4MB

    MD5

    c3a435943ce09135b2ecb8b725200d2e

    SHA1

    47af0f669281220cf8b3d6e12895c11a4323e407

    SHA256

    c772e81d94d37ae2c87880820efbb7dbf41e03454de5d67f80b9f8dcd4767439

    SHA512

    79ef9b925c09d8660c083ba143803bd491695b0adae217bd03214738229b009f8084c63add92c3d3d42e1ce060f2dcb10cb8fde1b6a5e33d0e718877f5fe70d5

  • C:\Users\Admin\AppData\Local\Temp\tmpF677.tmp

    Filesize

    20KB

    MD5

    c9ff7748d8fcef4cf84a5501e996a641

    SHA1

    02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

    SHA256

    4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

    SHA512

    d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

  • C:\Users\Admin\AppData\Local\Temp\u154.0.exe

    Filesize

    274KB

    MD5

    fae96a12ae35c2243801206ca089798d

    SHA1

    52b8769b202701900f03c386623232ee23fb90d3

    SHA256

    1b32e30cfeea17e7f29f8c907c42cafc3a18da4306007b5c5bc38cb6bb4f1750

    SHA512

    7a3d2284145b98b8db779e1a941f48125fd3fee00dc147fb6a2c0ecf0840b9c52973930871182e402726878de2bfb0dd7e4d64396e4280700511e2ac81aa7abe

  • C:\Users\Admin\AppData\Local\Temp\u154.1.zip

    Filesize

    1.6MB

    MD5

    9bb67e904ac371b5ffd143f8fb54e1e2

    SHA1

    58009e463133af8b89b59716fe255b118eca872c

    SHA256

    44afbc66f029be48db5d01678a0af7baf541e4a61d4b07391aa0470f0a961ded

    SHA512

    573c196dc87a1d3ea22b3ebdd2be1e4fbfbd3ea431694ec5e503f5cc6717b7d63a478c5c981ba5b467176aadd352c92f1d026b60a28b8ff76390af6903c1cdc0

  • C:\Users\Admin\AppData\Local\Temp\u154.2\doubled.doc

    Filesize

    1.2MB

    MD5

    f344794dc910dc343f92ded2c6b5e0ab

    SHA1

    e5878518ce55ce5bd1890d5e04a82eb22d5a848a

    SHA256

    3cf94707697ce0141960b05a15cbd3c3b791196995b1d21c4ff6bfb59997e235

    SHA512

    ee00ad0c728c750b6c75001ba52df7ef367bebf1cbc01e2c9370dd42b1867b5347d5e68254f427dddde3214f2fae1341ab76c7faa3a4724e1d1d43fae97d3a58

  • C:\Users\Admin\AppData\Local\Temp\u154.2\protactinium.log

    Filesize

    84KB

    MD5

    a276acc3fd657d7665bd4ddce8fb9749

    SHA1

    c02642eec3f4e8b0314045ee95e0a15abd853ea8

    SHA256

    6565f36d224ff27d89ad39a0d87f851f64308834d86e8a7cd02e9e1ea44187c8

    SHA512

    178476d229ff011cb1f39048acae46b42a80b2ec209b283a8237604646b09224446c5bb3a690191c4fd58813611d7c06b4fb23699cd76ad020a5d0bf4d456d79

  • C:\Users\Admin\AppData\Local\Temp\u154.2\run.exe

    Filesize

    446KB

    MD5

    485008b43f0edceba0e0d3ca04bc1c1a

    SHA1

    55ae8f105af415bb763d1b87f6572f078052877c

    SHA256

    12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10

    SHA512

    402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1

  • C:\Users\Admin\AppData\Local\Temp\u154.3.exe

    Filesize

    4.6MB

    MD5

    397926927bca55be4a77839b1c44de6e

    SHA1

    e10f3434ef3021c399dbba047832f02b3c898dbd

    SHA256

    4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

    SHA512

    cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

  • \ProgramData\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • \Users\Admin\AppData\Local\Temp\u154.2\ASUS_WMI.dll

    Filesize

    224KB

    MD5

    3f109a02c8d642e8003a1188df40d861

    SHA1

    f723f38471b8872443aa9177eef12a96c02cc84a

    SHA256

    6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5

    SHA512

    023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da

  • \Users\Admin\AppData\Local\Temp\u154.2\ATKEX.dll

    Filesize

    84KB

    MD5

    e68562f63265e1a70881446b4b9dc455

    SHA1

    da16ef9367bde3ce892b1a0e33bc179d8acdceb3

    SHA256

    c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb

    SHA512

    6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674

  • \Users\Admin\AppData\Local\Temp\u154.2\AsIO.dll

    Filesize

    120KB

    MD5

    f383f6f4e764619bd19e319335d3ef2b

    SHA1

    99f287e49a15e495b4ead8e5589364a5f87b357e

    SHA256

    03951dfe05bf74c61568aed50b9d8ce5ecf0e0c2b8e73bc37e1a699ae7eebc9d

    SHA512

    6fa960a084f42e6de25b74782d205c48ca9329997fc2ae8db902bb653da5e878ed92ced6b37472248d5bdc820fc48080ae4fce41556c4b20a049e30bf93d6934

  • memory/868-283-0x0000000007FB0000-0x0000000007FBA000-memory.dmp

    Filesize

    40KB

  • memory/868-272-0x0000000006550000-0x000000000656E000-memory.dmp

    Filesize

    120KB

  • memory/868-266-0x0000000005F20000-0x000000000641E000-memory.dmp

    Filesize

    5.0MB

  • memory/868-265-0x00000000058C0000-0x0000000005952000-memory.dmp

    Filesize

    584KB

  • memory/868-269-0x0000000005A20000-0x0000000005A70000-memory.dmp

    Filesize

    320KB

  • memory/868-268-0x0000000005960000-0x00000000059D6000-memory.dmp

    Filesize

    472KB

  • memory/868-267-0x0000000005BF0000-0x0000000005DB2000-memory.dmp

    Filesize

    1.8MB

  • memory/868-270-0x0000000005870000-0x000000000587A000-memory.dmp

    Filesize

    40KB

  • memory/868-271-0x0000000006A50000-0x0000000006F7C000-memory.dmp

    Filesize

    5.2MB

  • memory/868-273-0x0000000006630000-0x0000000006696000-memory.dmp

    Filesize

    408KB

  • memory/868-264-0x0000000001210000-0x00000000012D6000-memory.dmp

    Filesize

    792KB

  • memory/868-231-0x00000000705E0000-0x0000000071963000-memory.dmp

    Filesize

    19.5MB

  • memory/868-285-0x0000000007240000-0x0000000007252000-memory.dmp

    Filesize

    72KB

  • memory/1480-144-0x0000000000400000-0x0000000001A3C000-memory.dmp

    Filesize

    22.2MB

  • memory/1480-1-0x0000000001A90000-0x0000000001B90000-memory.dmp

    Filesize

    1024KB

  • memory/1480-145-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/1480-3-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/1480-2-0x00000000036B0000-0x000000000371D000-memory.dmp

    Filesize

    436KB

  • memory/1968-106-0x00000000724E0000-0x000000007265B000-memory.dmp

    Filesize

    1.5MB

  • memory/1968-114-0x00000000724E0000-0x000000007265B000-memory.dmp

    Filesize

    1.5MB

  • memory/1968-107-0x00007FFB7C590000-0x00007FFB7C76B000-memory.dmp

    Filesize

    1.9MB

  • memory/2764-228-0x0000000000400000-0x00000000008AD000-memory.dmp

    Filesize

    4.7MB

  • memory/2764-206-0x0000000000400000-0x00000000008AD000-memory.dmp

    Filesize

    4.7MB

  • memory/2792-215-0x00000000724E0000-0x000000007265B000-memory.dmp

    Filesize

    1.5MB

  • memory/2792-158-0x00007FFB7C590000-0x00007FFB7C76B000-memory.dmp

    Filesize

    1.9MB

  • memory/3724-232-0x0000000000400000-0x0000000002B02000-memory.dmp

    Filesize

    39.0MB

  • memory/3724-153-0x0000000000400000-0x0000000002B02000-memory.dmp

    Filesize

    39.0MB

  • memory/3724-205-0x0000000000400000-0x0000000002B02000-memory.dmp

    Filesize

    39.0MB

  • memory/3724-113-0x0000000000400000-0x0000000002B02000-memory.dmp

    Filesize

    39.0MB

  • memory/3724-117-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/5028-237-0x000001656EB80000-0x000001656EB8C000-memory.dmp

    Filesize

    48KB

  • memory/5028-252-0x0000016573560000-0x0000016573568000-memory.dmp

    Filesize

    32KB

  • memory/5028-253-0x00000165743F0000-0x0000016574428000-memory.dmp

    Filesize

    224KB

  • memory/5028-254-0x00000165746E0000-0x00000165746EA000-memory.dmp

    Filesize

    40KB

  • memory/5028-255-0x00000165746F0000-0x0000016574712000-memory.dmp

    Filesize

    136KB

  • memory/5028-256-0x0000016574C50000-0x0000016575176000-memory.dmp

    Filesize

    5.1MB

  • memory/5028-260-0x0000016574710000-0x000001657471C000-memory.dmp

    Filesize

    48KB

  • memory/5028-259-0x0000016574760000-0x00000165747B0000-memory.dmp

    Filesize

    320KB

  • memory/5028-261-0x00000165747B0000-0x00000165747D2000-memory.dmp

    Filesize

    136KB

  • memory/5028-262-0x0000016574740000-0x000001657475E000-memory.dmp

    Filesize

    120KB

  • memory/5028-241-0x000001656EC60000-0x000001656EC8A000-memory.dmp

    Filesize

    168KB

  • memory/5028-242-0x000001656F230000-0x000001656F2E2000-memory.dmp

    Filesize

    712KB

  • memory/5028-243-0x000001656F2E0000-0x000001656F35A000-memory.dmp

    Filesize

    488KB

  • memory/5028-246-0x0000016554C70000-0x0000016554C7A000-memory.dmp

    Filesize

    40KB

  • memory/5028-250-0x000001656F4C0000-0x000001656F7C0000-memory.dmp

    Filesize

    3.0MB

  • memory/5028-244-0x000001656F360000-0x000001656F3C2000-memory.dmp

    Filesize

    392KB

  • memory/5028-245-0x000001656F440000-0x000001656F4B6000-memory.dmp

    Filesize

    472KB

  • memory/5028-240-0x0000016554C60000-0x0000016554C6A000-memory.dmp

    Filesize

    40KB

  • memory/5028-239-0x000001656EBE0000-0x000001656EC04000-memory.dmp

    Filesize

    144KB

  • memory/5028-238-0x000001656EB70000-0x000001656EB84000-memory.dmp

    Filesize

    80KB

  • memory/5028-235-0x000001656EEF0000-0x000001656F000000-memory.dmp

    Filesize

    1.1MB

  • memory/5028-236-0x000001656EB60000-0x000001656EB70000-memory.dmp

    Filesize

    64KB

  • memory/5028-229-0x0000016550D80000-0x0000016554678000-memory.dmp

    Filesize

    57.0MB