Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
11fe0882c360c4b208c03caa089c3aa0N.exe
Resource
win7-20240705-en
General
-
Target
11fe0882c360c4b208c03caa089c3aa0N.exe
-
Size
128KB
-
MD5
11fe0882c360c4b208c03caa089c3aa0
-
SHA1
5fc0397a9b2938f39afb69c5ddae71afda455bfd
-
SHA256
b9d2dd1adbae01ebeda5538c2272c30b42e9ffb6de994ca5f42e7defd1a1d8aa
-
SHA512
8b1942cd6cbe84ef788123f56377fa2ed86b8e56043b0ee2f62ff8cd7b1b4a52f5965ec8a3471569f85ca58250f99305a8202aae0367d0f72ed3ef10195f52f3
-
SSDEEP
3072:uGHi6mwRua376jRLg//bZv1nlLNruJheyMPGEHrKHHySbQwkn:+GvujRLg//bt/gJh0PGEunbQw
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://209.59.219.90/forum/viewtopic.php
-
payload_url
http://realitycoaching.es/pm3Wi2bw.exe
http://foundationdevelopment.org/k6npG.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 11fe0882c360c4b208c03caa089c3aa0N.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 11fe0882c360c4b208c03caa089c3aa0N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2056 set thread context of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeImpersonatePrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeTcbPrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeChangeNotifyPrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeCreateTokenPrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeBackupPrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeRestorePrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeIncreaseQuotaPrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeAssignPrimaryTokenPrivilege 2532 11fe0882c360c4b208c03caa089c3aa0N.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 PID 2056 wrote to memory of 2532 2056 11fe0882c360c4b208c03caa089c3aa0N.exe 30 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 11fe0882c360c4b208c03caa089c3aa0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:2532
-