Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
109s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
11fe0882c360c4b208c03caa089c3aa0N.exe
Resource
win7-20240705-en
General
-
Target
11fe0882c360c4b208c03caa089c3aa0N.exe
-
Size
128KB
-
MD5
11fe0882c360c4b208c03caa089c3aa0
-
SHA1
5fc0397a9b2938f39afb69c5ddae71afda455bfd
-
SHA256
b9d2dd1adbae01ebeda5538c2272c30b42e9ffb6de994ca5f42e7defd1a1d8aa
-
SHA512
8b1942cd6cbe84ef788123f56377fa2ed86b8e56043b0ee2f62ff8cd7b1b4a52f5965ec8a3471569f85ca58250f99305a8202aae0367d0f72ed3ef10195f52f3
-
SSDEEP
3072:uGHi6mwRua376jRLg//bZv1nlLNruJheyMPGEHrKHHySbQwkn:+GvujRLg//bt/gJh0PGEunbQw
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://209.59.219.90/forum/viewtopic.php
-
payload_url
http://realitycoaching.es/pm3Wi2bw.exe
http://foundationdevelopment.org/k6npG.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 11fe0882c360c4b208c03caa089c3aa0N.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 11fe0882c360c4b208c03caa089c3aa0N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5072 set thread context of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeImpersonatePrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeTcbPrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeChangeNotifyPrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeCreateTokenPrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeBackupPrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeRestorePrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeIncreaseQuotaPrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe Token: SeAssignPrimaryTokenPrivilege 2304 11fe0882c360c4b208c03caa089c3aa0N.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 PID 5072 wrote to memory of 2304 5072 11fe0882c360c4b208c03caa089c3aa0N.exe 86 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 11fe0882c360c4b208c03caa089c3aa0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"C:\Users\Admin\AppData\Local\Temp\11fe0882c360c4b208c03caa089c3aa0N.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:2304
-