Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe
Resource
win10v2004-20240802-en
General
-
Target
356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe
-
Size
553KB
-
MD5
b0f79857a999521f20975297421e41af
-
SHA1
66cd2849f7e3dba7476283ae313d2738c32a2e9a
-
SHA256
356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea
-
SHA512
8df4f82c62336cb68933c51d114c59ba0eacf425c71a87c9efe6c1073f4172225830ec71fa2ab81da6e61ad2c032b79cc98b925605024147d54e62ff7aadd8fc
-
SSDEEP
12288:fu7kvDoQ1DgXu7eIN0oNv04cdIkYAyw1yD1MDQ/HxfGi+kdJ:fuoZDgXuaVGvx+KAbERMDQ/+kdJ
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7342466652:AAH0FO5Nw0u2N8HT41ehcQTwKTOCbumkJLg/sendMessage?chat_id=7399860345
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2632-30-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2632-29-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2632-28-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2632-25-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2632-23-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2700 powershell.exe 2752 powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2264 set thread context of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1652 2632 WerFault.exe 38 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2868 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 2632 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 2700 powershell.exe 2752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe Token: SeDebugPrivilege 2632 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2700 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 31 PID 2264 wrote to memory of 2700 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 31 PID 2264 wrote to memory of 2700 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 31 PID 2264 wrote to memory of 2700 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 31 PID 2264 wrote to memory of 2752 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 33 PID 2264 wrote to memory of 2752 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 33 PID 2264 wrote to memory of 2752 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 33 PID 2264 wrote to memory of 2752 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 33 PID 2264 wrote to memory of 2868 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 35 PID 2264 wrote to memory of 2868 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 35 PID 2264 wrote to memory of 2868 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 35 PID 2264 wrote to memory of 2868 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 35 PID 2264 wrote to memory of 2912 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 37 PID 2264 wrote to memory of 2912 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 37 PID 2264 wrote to memory of 2912 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 37 PID 2264 wrote to memory of 2912 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 37 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2264 wrote to memory of 2632 2264 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 38 PID 2632 wrote to memory of 1652 2632 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 39 PID 2632 wrote to memory of 1652 2632 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 39 PID 2632 wrote to memory of 1652 2632 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 39 PID 2632 wrote to memory of 1652 2632 356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe"C:\Users\Admin\AppData\Local\Temp\356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ahdRPqrqmmIFRa.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ahdRPqrqmmIFRa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFA75.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe"C:\Users\Admin\AppData\Local\Temp\356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe"2⤵PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe"C:\Users\Admin\AppData\Local\Temp\356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 10963⤵
- Program crash
PID:1652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD564699c78efc9d5393fa78f3c96905dae
SHA14adf4c55401400d2c25c63c2467f266da017451a
SHA2568ce3bb1d845a63df4e107539b8cfee380e3b3d8ca6f728aa97c052402d86a913
SHA512a3d8a8cb3c48583b9bfffda698b470770fcb0f4118cef5b100773ad7b643ad2844e27133876029b3ad7cc165daaa689f7927670c997e7a8be20a61e30cbd44b0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PNU5U1O9E3J4WZPZB4GQ.temp
Filesize7KB
MD5d1900ecb4120794d6fb1766b859864f5
SHA171ca612a8da86510b244d1ba984a5e7c4961152d
SHA2564325a27003aeb3158ea40b0826bf59b3c8d91b14055699eff6280702554b78fc
SHA5122bb9b8c6d604fc44f43d3850da73b209f650817757b53b38ce6765950fb6bc0ca849ded6359588ce8ad549a85ac06b74673aed13dea160dcc46efc2ad2fea2da