Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
quotation.pdf.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
quotation.pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
quotation.pdf.exe
-
Size
584KB
-
MD5
cae995edd90312264f9faa534874894f
-
SHA1
2a71f016765dc5fa825ca1f437e1df02c32611a0
-
SHA256
5226c6707f7f1430f49c6c7cd637375b00004be37d815d82804257a8ca563841
-
SHA512
6bd8c914fbdc8b04bdf12a8a60eb61324e4e06dfdd7525d29418c861247dda366e367992afd4d285a15b8ca71df5d28ddc1056cb91df3d9d1461c888bce8d594
-
SSDEEP
12288:HrLfSC/W39Rfyyii2nYUNm8AEr8aNZibViwt5XHF:LLbcyyii2nYUm8AErTsiw5V
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6086388911:AAGHpITQe4oLJhzRR86O2JB3Tmd1xG2gIqM/sendMessage?chat_id=1932526247
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2996-30-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2996-29-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2996-28-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2996-25-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2996-23-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2060 powershell.exe 2380 powershell.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1292 set thread context of 2996 1292 quotation.pdf.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language quotation.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2676 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2380 powershell.exe 2060 powershell.exe 2996 RegSvcs.exe 2996 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2380 powershell.exe Token: SeDebugPrivilege 2060 powershell.exe Token: SeDebugPrivilege 2996 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2060 1292 quotation.pdf.exe 31 PID 1292 wrote to memory of 2060 1292 quotation.pdf.exe 31 PID 1292 wrote to memory of 2060 1292 quotation.pdf.exe 31 PID 1292 wrote to memory of 2060 1292 quotation.pdf.exe 31 PID 1292 wrote to memory of 2380 1292 quotation.pdf.exe 33 PID 1292 wrote to memory of 2380 1292 quotation.pdf.exe 33 PID 1292 wrote to memory of 2380 1292 quotation.pdf.exe 33 PID 1292 wrote to memory of 2380 1292 quotation.pdf.exe 33 PID 1292 wrote to memory of 2676 1292 quotation.pdf.exe 35 PID 1292 wrote to memory of 2676 1292 quotation.pdf.exe 35 PID 1292 wrote to memory of 2676 1292 quotation.pdf.exe 35 PID 1292 wrote to memory of 2676 1292 quotation.pdf.exe 35 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 PID 1292 wrote to memory of 2996 1292 quotation.pdf.exe 37 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation.pdf.exe"C:\Users\Admin\AppData\Local\Temp\quotation.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\quotation.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VBwlAonrdTz.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VBwlAonrdTz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp81C.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2676
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56f3ba7bb28cecfcda4c23a9b2f6a3fea
SHA1e53aec7e5f54bb9a490ba4d859638d6fc40278ee
SHA25693c5dabba0756cf5bcea9758f845f8d094e8e93d3b4f4d363e7c2ab1d38d01d7
SHA5128876dc0d03fbbb06da6d016de2f0269d7af940dbe25f3e43fb97924a700c02420e1efe1604616072f2d9c87a74e019f1f31628727a5bdc7caba4d01b396f47dd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5a7022c5b69dd58e795eb3cb22bec14f1
SHA1d6b61462e4dfd8278d75a777b8fafd7cb9f389e3
SHA2566d6f2e70dd199c1d6f6da142a914968028097b87e02dfe4f71d83bfdd2462076
SHA5129285adcccd525f5461d50f4b98822065d814666b55a323c869e7c12fe502aecb556e1a43954a313d390737d32bdab784cfefed4b6f533ff6ac0c92a7defa5317