Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/07/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe
Resource
win10v2004-20240709-en
General
-
Target
a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe
-
Size
370KB
-
MD5
0d0b2d2e8e757e66ae44a0e3aeed2512
-
SHA1
029d6b6dab4f3b33806fcdb8ec9b457e1c7d46f6
-
SHA256
a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547
-
SHA512
023a413eddd057e2253b2e674329000b14423c23db78eb61ee91538e0a73beb3e58326bc85405762ad7cd2152d6158fb844b2b8003c9b635b46b039c0010bd4b
-
SSDEEP
6144:hTNLdeErsZ/lyvUpo9lq4PT3fbf0FIMPoB4ikVTRcv2oFDXTUbEpQqee:nLgErJ3L0F5C4px82rEp6e
Malware Config
Extracted
stealc
hnew
http://85.28.47.70
-
url_path
/570d5d5e8678366c.php
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4772 set thread context of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1628 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3472 RegAsm.exe 3472 RegAsm.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 4772 wrote to memory of 3472 4772 a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe 80 PID 3472 wrote to memory of 572 3472 RegAsm.exe 83 PID 3472 wrote to memory of 572 3472 RegAsm.exe 83 PID 3472 wrote to memory of 572 3472 RegAsm.exe 83 PID 572 wrote to memory of 1628 572 cmd.exe 85 PID 572 wrote to memory of 1628 572 cmd.exe 85 PID 572 wrote to memory of 1628 572 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe"C:\Users\Admin\AppData\Local\Temp\a531cf5568b7ab1e70b269186601bedacd734851da989ac6d37771f1b0b87547.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:1628
-
-
-