Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
quotation.pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
quotation.pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
quotation.pdf.exe
-
Size
584KB
-
MD5
cae995edd90312264f9faa534874894f
-
SHA1
2a71f016765dc5fa825ca1f437e1df02c32611a0
-
SHA256
5226c6707f7f1430f49c6c7cd637375b00004be37d815d82804257a8ca563841
-
SHA512
6bd8c914fbdc8b04bdf12a8a60eb61324e4e06dfdd7525d29418c861247dda366e367992afd4d285a15b8ca71df5d28ddc1056cb91df3d9d1461c888bce8d594
-
SSDEEP
12288:HrLfSC/W39Rfyyii2nYUNm8AEr8aNZibViwt5XHF:LLbcyyii2nYUm8AErTsiw5V
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6086388911:AAGHpITQe4oLJhzRR86O2JB3Tmd1xG2gIqM/sendMessage?chat_id=1932526247
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2792-30-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2792-29-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2792-28-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2792-23-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2792-25-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2920 powershell.exe 2480 powershell.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1076 set thread context of 2792 1076 quotation.pdf.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language quotation.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2808 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2480 powershell.exe 2920 powershell.exe 2792 RegSvcs.exe 2792 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2480 powershell.exe Token: SeDebugPrivilege 2920 powershell.exe Token: SeDebugPrivilege 2792 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2920 1076 quotation.pdf.exe 30 PID 1076 wrote to memory of 2920 1076 quotation.pdf.exe 30 PID 1076 wrote to memory of 2920 1076 quotation.pdf.exe 30 PID 1076 wrote to memory of 2920 1076 quotation.pdf.exe 30 PID 1076 wrote to memory of 2480 1076 quotation.pdf.exe 32 PID 1076 wrote to memory of 2480 1076 quotation.pdf.exe 32 PID 1076 wrote to memory of 2480 1076 quotation.pdf.exe 32 PID 1076 wrote to memory of 2480 1076 quotation.pdf.exe 32 PID 1076 wrote to memory of 2808 1076 quotation.pdf.exe 34 PID 1076 wrote to memory of 2808 1076 quotation.pdf.exe 34 PID 1076 wrote to memory of 2808 1076 quotation.pdf.exe 34 PID 1076 wrote to memory of 2808 1076 quotation.pdf.exe 34 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 PID 1076 wrote to memory of 2792 1076 quotation.pdf.exe 36 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation.pdf.exe"C:\Users\Admin\AppData\Local\Temp\quotation.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\quotation.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VBwlAonrdTz.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VBwlAonrdTz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC236.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2808
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD573068274418846bd103b48d0a30cec42
SHA159c519670fd056de6f6133753e6ef8729095555d
SHA256cebf6048ff39b70fb809f977ade6eab1b144f6cee680d54da3089d2fd7ed45ea
SHA512ee73b768f7646e084507656c2ff6f9eb3708c20c23ccc4ad2c38afa3cb9b0d5881241e6231cbddee1b96cb1ca58e82df51f4c64b653da9868d730ee79b909134
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4T62ZXELFF86T17332OC.temp
Filesize7KB
MD5f012b810af4d29183969f11c6430ecf9
SHA1c7a94bb127f4046ca1c46bcc7bfd34b27ff2811e
SHA256ea92bf00ff5565c2c106fc66cd2d51b3429e4080e19439bbf98e9363a1720fea
SHA5126bc8c34f73dd4152ae16f94bd36a735e100557ca973cec7c0f3209df63771912ccd1321f325a5a3bab4770acc83e0cb960c36aa5e41968649d7c35247e00b65d