Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    52s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 03:24

General

  • Target

    trolled.exe

  • Size

    4.3MB

  • MD5

    e24cc98957c91dabed02cf84e47b8278

  • SHA1

    00607cff2e6d37b6f271f5e5f8794024814722ee

  • SHA256

    6f819a3dbe5ac75261f157c14035baf0f72bf93033c12e581def1a4cdf9f8039

  • SHA512

    aafca528c9ca2f4e756df04e0b95862cd872b712fe5c3138752d9f65de90f340423d7bab976d9c6a1d890118c720026a9d8b9a229d4dee78dc02d6595f31cc41

  • SSDEEP

    98304:pIgu5JSgwY2bb+YIqdhoBmoziggpNamZTHwwYFiFN:pVu/SSE6YboBmo23KmZTHwwN

Score
10/10

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1256063120926052463/-iFGknjVKFXSNv3DZWbEqQQxHdmFRgLmT1KDCJ79ELk0eZPk3sQv7UfngRseF16uBUN5

Signatures

  • Skuld stealer

    An info stealer written in Go lang.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trolled.exe
    "C:\Users\Admin\AppData\Local\Temp\trolled.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracker.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "start /min "" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe""
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe"
          4⤵
          • Executes dropped EXE
          PID:2888
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "start /min "" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wompwomp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wompwomp.bat"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2384
          • C:\Windows\SysWOW64\cscript.exe
            cscript /nologo /e:jscript "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wompwomp.bat"
            5⤵
              PID:1608
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "start /min "" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\website.bat""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2352
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RarSFX0\website.bat"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2412
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=fboNTcjJ8bo
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1508
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:275457 /prefetch:2
                6⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:1700
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "start /min "" java -jar "C:\Users\Admin\AppData\Local\Temp\RarSFX0\iidk.jar""
          3⤵
            PID:2348
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c "start /min "" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskkiller.bat""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2368
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskkiller.bat"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2520
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im cmd.exe /f
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2284

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        cf5f8ce35acfba0c30fa477d5a890370

        SHA1

        bb1241be762f788be66fca108d6bd364d21da45e

        SHA256

        66a902bd473d8dbd85c480c95e70ace1d85adcbec30ce8b2a4beba064c0d7254

        SHA512

        b06aca79be6fe0f96ac86857352078e9877406040868ce73e7e915f19a7b355e0039d21bf5e3205f8d8d6fdc9577e492efb0e1281b61d6ce73e6eb3bf028e83a

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        d7f9b6e10054ba5b8d76faa44c8d9c7a

        SHA1

        7a4bb5138f29b96a23cc7de1460a63b47b0c5ea1

        SHA256

        de2e5c4e2be5edab42e5f914549baf2ba2a046a9af810755fcc05573f1832dcb

        SHA512

        17d6aa2f8ec301af85ad874221f93d8d6659902a5128964915f592c444aa6a8db945262446f42f0665949dc48e1acd186b02589ee1623bc0192c6f00961bc095

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        1e396dcf5d7947347d28f2f41300753f

        SHA1

        15be61ebdb9a9178bfce536319a602465990c2a2

        SHA256

        03f60d8e19664d9c0369cde3b13d1a2e51b258fefb45f9e6cc2af6cf9b0c2227

        SHA512

        3739495a349feec2b8f61c861213b78c1bfc114b865347db34f3a85e26256a5f1426a8cc1f04e2fc97a37957a9a4bee29588c3b68647d410502dc2afe2c12f34

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        24d94f2a88f5f66d7e3a7370440977cb

        SHA1

        e8aa982f4f092cc668ec7a7d567804230dd5b73d

        SHA256

        c52a2602d0c6fcddda43695106206d16029677ce74f7b3b0c237ed73e78176b6

        SHA512

        9914f07651463d08f4f75a5272516fd5b31f43d21bd7e5269da050bbc3eb9ca5a3119c72523a139b84cbfa164e35df518c63b5c5d3d65e407ffc9a102866f0f0

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        a603bc9499bf8ba319937325bc18dc7d

        SHA1

        9f58a8032e37625645f33e8a30b5017f281e6b3f

        SHA256

        82ca97394e71178cb124508a8d257fb85dbb0183f8df3b4d24fb93dd63d0c1b4

        SHA512

        21669c42cdc7014c5959440efbd76df49cb68d392bed44bd661b31cc15d55cdfa8120a674d98b9766bac01bb999327879cb8fe46be5e78d532ab8f967e0d068a

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        f1a45731de60ad9eee61ea441d0aeb1e

        SHA1

        9d26c4cd63cf813fbda3afa518d7236ee18f0e4f

        SHA256

        963e71177fa5b7c4130784c6e121c445bac9af82f912cbc0c1900087bec4d30b

        SHA512

        a6a372a6a19ea18549657383e77207a36cfa9ce066ce0d1c8c5cdfc040f540933e8d8e59ac94a49b4dd5fb55f89c65db25175f1ab818a8bbd77c80dfcf92c276

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        e44383b1ff80c47c35a4a25276a0950d

        SHA1

        fb8f0e0c323f07e23c0f4b500a17e66e75b997c0

        SHA256

        500aad0f195fa0fb6d75d730cba48eac892c58d26ef468084272a38b9b5d23eb

        SHA512

        46407f6ed0ec7e44abc8c78624bbdba74db76e0613790b747eb977f3e5c4e8a2bb37956ea892695ba7d520509f350dd290a28fc8aeef3f7fb90c0474c6d0cad7

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        eece9683d550f444fe998f7526bc2e9a

        SHA1

        1d83e878e52fb1079916430a9260126a9f846f22

        SHA256

        946f5796ceff73f97dea38c81c59ecb5c10050083161d4b748d4291c63fb96f0

        SHA512

        a04731d91130f5cc6a0e61ed85f00ed62cd83039471c492344d14be583bb21d814341350f6b8b204581bf3a87f29ad2d4e2c0bbd84955786a1adcc1ca38ad35c

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        728f690586fcfb02cfb0a2e535d3522a

        SHA1

        3432e6c3984a65e57d50a296ef0c7f97cd7a94da

        SHA256

        8117a0a0ac9c6e6e1d138c3ed01fc79823f3108e4b0277bf573ad698f676644e

        SHA512

        d3eadadd180ad33fd32fb05454724f2bfcff2ea56ac9f41d67b0310faba1ca1f7e7206c8e17fd681e5dbbd22797983f7691938e42ffadf0ad8a4958e6ecc1203

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        342B

        MD5

        3b814da16850deee23dd4e10bd53d58a

        SHA1

        479b8a96e55b8c15593deb6e649f1af21162cc83

        SHA256

        c9fad4bb7e6f2a8392b947ae732c0344a38bf3fc761cfd0f7be3da904db3a27d

        SHA512

        42a013a882ec4355dd4dce38992f944d47cb0c83544eab543b856f938f6a1ce78e91b0e5f96170c58adafd8b0c2a6a4d265702042f367113815c045f4078a016

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jw2rl61\imagestore.dat

        Filesize

        1KB

        MD5

        9b5ae643b3485e0f4b5445793e72ce98

        SHA1

        bf4cb1b5b995ae4d369bb9377c0f710eac42827a

        SHA256

        39c782a7f2e77b5ed763bb8311080a686aa05f9aff4184c2d4319ec32cce7b06

        SHA512

        165078368287b75d65f904224912409ec6e5938df30d475ed84ddc161b7ea9e5dc461ac6791cd5bdf25ef26e03560ae16a07adafc41a402188028db87c16df65

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\favicon[1].ico

        Filesize

        1KB

        MD5

        f2a495d85735b9a0ac65deb19c129985

        SHA1

        f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

        SHA256

        8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

        SHA512

        6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

      • C:\Users\Admin\AppData\Local\Temp\Cab1E4D.tmp

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracker.bat

        Filesize

        563B

        MD5

        76c3d1865f41ab708d1e2accf999d3c8

        SHA1

        9502f0b7e4387a1facbc30ef0cc5915cd15da126

        SHA256

        d23dd8777f83432b7583ab2e41b07dd5406b114bd3bd50eaf8a841476099bd43

        SHA512

        cd800c73ec7cd61df4e4f7613af05aa067b7c07fd4bf1cbdc3e978887a1106e0d849d02b42d5d231049af62625ed39029a95197d1daa976672f20831f4ae7a78

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskkiller.bat

        Filesize

        54B

        MD5

        18ef03e1045b224a70d9afdf8247a241

        SHA1

        117b3959ded227b5cf0015229db0386f6479df70

        SHA256

        daf87ae302bcd7c7a65f6db2b93216116de0621169f724f564812a6a8614f33d

        SHA512

        2ef552283ed844801dc6b7a2ec143e1e52f77b6f7ee2516bb70b3c8db6592eaef9e435f063bbb94019ac135c2e37ccfcb9db8f926a7358c3590b3fc9c63beafd

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\website.bat

        Filesize

        74B

        MD5

        b3be17a14609d812602af67da8b7acc2

        SHA1

        e1fcc3e3989ee6846694eba252622a336ce63795

        SHA256

        f6cb1a4b508b1650cc1eaa607f545e50967157eef4f676de39836f2806d63b81

        SHA512

        780a624a79bb3b293d83017595f709dd9fdc9e645f9c8bc5102aacaaad89a622e6a0dae9ea30fc3679378f6fe4afe34937f4909594c32351ee831917e8b0c1a7

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wompwomp.bat

        Filesize

        340B

        MD5

        6943c2eb7e78b8b8cb8171b940de20f2

        SHA1

        e428c6dc0ffc17ab70178765e0bcb23dc0c12b8a

        SHA256

        eb79d4bf846dfbd540085f0972658373f26709f281dfb88ad461f9df03d83095

        SHA512

        1d628f3c5ac6e41ed14cc0069bde0278248e32c77e2e111bc842a71ba62d52913b47fb29402ce79b3d0880b6b5763b0d9906d6fb65bcfdf33103aefa0044552b

      • C:\Users\Admin\AppData\Local\Temp\Tar1E4E.tmp

        Filesize

        171KB

        MD5

        9c0c641c06238516f27941aa1166d427

        SHA1

        64cd549fb8cf014fcd9312aa7a5b023847b6c977

        SHA256

        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

        SHA512

        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

      • C:\Users\Admin\AppData\Local\Temp\Tar1F2E.tmp

        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      • \Users\Admin\AppData\Local\Temp\RarSFX0\skuld.exe

        Filesize

        9.5MB

        MD5

        396758811eab54260eab74b18729ad1d

        SHA1

        3240b27807b2d42877f80565da042a8efefece23

        SHA256

        65263fc409ca9fd3fa186f3774a0705664a42102c94cda95b0c753dc98f7d11a

        SHA512

        b5c8c27fd521ca13b74eb26948345086f1289a1c2699753b0b3e296801abb72649d8d017763fd41e48634a2b3192e1714eb2feb1bea04db7d929cef653f28bb7