Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/09/2024, 17:25

General

  • Target

    2024-09-05_88e5f7fcb3a6b6f2ebb54bbdaae394e5_icedid_jrat_sakula.exe

  • Size

    21.3MB

  • MD5

    88e5f7fcb3a6b6f2ebb54bbdaae394e5

  • SHA1

    a1797481b116c8f9d6dbf72b538ec200528a0aa4

  • SHA256

    db12041535a38a59fc09b85f67302cbc9859b0f444c5fa677bcfd4f4f3b8e303

  • SHA512

    c8de757766df4c27f092320f07906886cb3a4e39eea82f9da5abcf0f9555c8eaa9e3c333321e5738066368584c5c2b75528b27bd92a08f833b2c05b0d3ae1aad

  • SSDEEP

    196608:w1zsKFJndotUVMbUJfF7PD2pbJ6VszmYN8jqqw8o3BNYtRlR:WPFJm6VorNk28o3gtRj

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 4 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-05_88e5f7fcb3a6b6f2ebb54bbdaae394e5_icedid_jrat_sakula.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-05_88e5f7fcb3a6b6f2ebb54bbdaae394e5_icedid_jrat_sakula.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\Documents\Tomcat.exe
      "C:\Users\Admin\Documents\Tomcat.exe"
      2⤵
      • Deletes itself
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\conf.ini

    Filesize

    218B

    MD5

    0da3fe479e80097442bd49221a6b350a

    SHA1

    b6282b7a231ae343addda71355e87893e1ad5824

    SHA256

    e1ec86f4e5d584cb2b4659164cd3b409b99756742a95814dfcdfecffa164ab1e

    SHA512

    30360772ac29aa3d3f8cf243605b25d7871ca771832123785a3d17861495884d2d063436f6b0ee7528c06558f2db3d2b4d6b9d4768d667b5f6887f41f18f6992

  • C:\Users\Admin\Documents\conf.ini

    Filesize

    225B

    MD5

    27d0fbd1ec2e45fcb3b188759f00ca69

    SHA1

    32e6c2b0d4fe661c772cd3c7013dd758cdf4060c

    SHA256

    deced7dae9f9d3729078ef25f2a4d48d3bb38251f436e4fde91a6df4b5118070

    SHA512

    ad539456b537fedd0443b4fd22f726070cd509fa1b9c2b0233383f16c565e7fd22b79f2040d1055c4c03da5c309699b58a2bcda08fb8b9e134a9314e06929f2a

  • \Users\Admin\Documents\Tomcat.exe

    Filesize

    1.6MB

    MD5

    4450058efd92854936ddb1c7a7619c4a

    SHA1

    5bb4e2a8d4e8d16d9aa15f728c453f56fca24405

    SHA256

    356ba962940bc10e18343aee4f6943147b55c6a8778d06df4eab6e401cee89a5

    SHA512

    b66dc4f173a7370446a51fcdfc82d29db837097788a3cf3f82c1bc9a0c54bb96a9cbec119446bb25823d8cab5a2eb8888f8042b8e48a3ade524e1159a9af4180

  • memory/2228-11-0x0000000010000000-0x0000000010109000-memory.dmp

    Filesize

    1.0MB

  • memory/2228-17-0x0000000000160000-0x000000000018B000-memory.dmp

    Filesize

    172KB

  • memory/2228-20-0x00000000002E0000-0x00000000002F8000-memory.dmp

    Filesize

    96KB

  • memory/2228-21-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-26-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-27-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-29-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-30-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-32-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-33-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-35-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-36-0x0000000000BE0000-0x0000000000D9B000-memory.dmp

    Filesize

    1.7MB

  • memory/2228-37-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-39-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-40-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-42-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-44-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-46-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-47-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-49-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-51-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-53-0x0000000000BE0000-0x0000000000D9B000-memory.dmp

    Filesize

    1.7MB

  • memory/2228-54-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-55-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-57-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-58-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-60-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-61-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-63-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-64-0x0000000000BE0000-0x0000000000D9B000-memory.dmp

    Filesize

    1.7MB

  • memory/2228-65-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-67-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-68-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-70-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-71-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-73-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-75-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-78-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-79-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-81-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-82-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-84-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-85-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-87-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-88-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-91-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-92-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-94-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-95-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-97-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-98-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-100-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-101-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/2228-103-0x00000000022A0000-0x00000000022F9000-memory.dmp

    Filesize

    356KB

  • memory/3040-1-0x0000000010000000-0x0000000010014000-memory.dmp

    Filesize

    80KB