Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/09/2024, 06:22

General

  • Target

    Trojan.MSIL.Poullight.PA.exe

  • Size

    3.1MB

  • MD5

    3be8fa0b38501cdb368c5cf5a0615880

  • SHA1

    52083abf2794b5f6f8a429ef5bf5fa552896832f

  • SHA256

    1d0c2228e4f710999bd97385b1595cd48bc9b79a837a01eff63efb470a1f92ba

  • SHA512

    4d60b1c7d41f9a03147cf1d81640d9b6cd09078c9a8e1634006f505c95cf81a3f0a2f3f31b6c925fd9c90be6c733cac7a54cadf19b0dd0b63ea2b2d8a78ea5bd

  • SSDEEP

    49152:eFnAp4kyST0QX9i41ZmCq6M+s8KuqGaX0ToIBAUZLYRXcYz7NWu22wS3BNM8:eFw7ySwQX9iC4n0JBAUZLuMYz1BN

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 2 IoCs
  • Poullight

    Poullight is an information stealer first seen in March 2020.

  • Poullight Stealer payload 3 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan.MSIL.Poullight.PA.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.MSIL.Poullight.PA.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\build.exe
      "C:\Users\Admin\AppData\Local\Temp\build.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1256
    • C:\Users\Admin\AppData\Local\Temp\SALIK.exe
      "C:\Users\Admin\AppData\Local\Temp\SALIK.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://jq.qq.com/?_wv=1027&k=57Cts1S
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa458946f8,0x7ffa45894708,0x7ffa45894718
          4⤵
            PID:4324
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11453865943558634247,4608636329143317184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
            4⤵
              PID:2680
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11453865943558634247,4608636329143317184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4224
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11453865943558634247,4608636329143317184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
              4⤵
                PID:3684
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11453865943558634247,4608636329143317184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
                4⤵
                  PID:4188
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11453865943558634247,4608636329143317184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
                  4⤵
                    PID:1540
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11453865943558634247,4608636329143317184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
                    4⤵
                      PID:2944
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:2504
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:4540

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    27304926d60324abe74d7a4b571c35ea

                    SHA1

                    78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                    SHA256

                    7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                    SHA512

                    f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    9e3fc58a8fb86c93d19e1500b873ef6f

                    SHA1

                    c6aae5f4e26f5570db5e14bba8d5061867a33b56

                    SHA256

                    828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                    SHA512

                    e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\702b6da3-d101-43f5-9cd5-8bb5d6cfe438.tmp

                    Filesize

                    5KB

                    MD5

                    aab8fe65774dd79b6cb2147c1a8acec4

                    SHA1

                    3b12a13ea6e4a7257bc8dc6bf5b04c6cb8f7e516

                    SHA256

                    070c781869d0ccbdff0a5f7eac08ffdc25e6bd7544f459feeac307971124dcb7

                    SHA512

                    b55f550c3b7cd91775e5caf9a10828e3e9a5e14b881b7ae0288018059dbc5f6666658c663107d48fc7fa4e6e1b0af0c6d260c77424a80afa09470ff74dbbb1e9

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                    Filesize

                    111B

                    MD5

                    807419ca9a4734feaf8d8563a003b048

                    SHA1

                    a723c7d60a65886ffa068711f1e900ccc85922a6

                    SHA256

                    aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                    SHA512

                    f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    6KB

                    MD5

                    943100534e708efea4923a0864b65b9c

                    SHA1

                    3de333ff9744379295217d17cf0ff367debaf90f

                    SHA256

                    ef743622a7d8313edfc48884f7d937bff53da0f9c0f1cbee52ed816a03ba8d8e

                    SHA512

                    a27ff1003fc174a5799405c0eb4d762ee0ebbf585d1efbd42b4c9044113fd9258be315d33d5cdd5d7dbe006594ced6aafc95f4d62767250052bfcf9c02ad4741

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                    Filesize

                    10KB

                    MD5

                    ff517d77cd3894651f3a2948df88aad7

                    SHA1

                    3a2bcada3c0c80bb0885868360d5e3fbc5967688

                    SHA256

                    4d6de38e1f15f39dc8cdd181f5bf73eabce4e3daab34095cc23b1898374e8096

                    SHA512

                    60f1fe0e23d2b15f7c5403b5b7dd4b87a63c955ee021ced5a997a670330c60f2ee12e71e4799822e2f47cfa54a681e4b26d71172563c3b430c6c24896a9f4e58

                  • C:\Users\Admin\AppData\Local\Temp\SALIK.exe

                    Filesize

                    3.0MB

                    MD5

                    d0bb5ffd1587460bdc47b813edde4c45

                    SHA1

                    f81429c4f3b3711be166a13c3736bd13a77e200a

                    SHA256

                    297aafb2fee9ca3a270f8b6189699c71f60281c5ad3d4a217139d9b97aca22f4

                    SHA512

                    e8c135e7cfec7d8eed4a10315edb65839914dbbdda660257565002fdf3bba39685a27418e11c3f77781e76b730ac60435b8381dd85d92de529305ac5a6053327

                  • C:\Users\Admin\AppData\Local\Temp\build.exe

                    Filesize

                    100KB

                    MD5

                    7151a5a9e84c669ffcee99029e679cd3

                    SHA1

                    8d596f5f14dabb069242f04797f70f288657017e

                    SHA256

                    d8712c18fd5c3d02d1f799c5b829050dbe8932187d0ce2ce7d1cfe9741fa8b60

                    SHA512

                    83ca6940e55c2a84ab2597e9a8102b9ff5d6da3b4b07c164b3ae57780a85e2358dbb93f1abe02ef68defcd53eee637ed2e11168977d4d326f6535a33edc9a2a0

                  • memory/1112-92-0x0000000002510000-0x000000000261D000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1112-26-0x0000000002510000-0x000000000261D000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/1256-81-0x0000025E7CF80000-0x0000025E7D142000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/1256-52-0x0000025E61D80000-0x0000025E61D8A000-memory.dmp

                    Filesize

                    40KB

                  • memory/1256-84-0x0000025E7D680000-0x0000025E7DBA8000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/1256-91-0x00007FFA4A050000-0x00007FFA4AB11000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/1256-24-0x00007FFA4A050000-0x00007FFA4AB11000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/1256-13-0x00007FFA4A053000-0x00007FFA4A055000-memory.dmp

                    Filesize

                    8KB

                  • memory/1256-12-0x0000025E61880000-0x0000025E618A0000-memory.dmp

                    Filesize

                    128KB

                  • memory/1824-23-0x0000000000400000-0x000000000072B000-memory.dmp

                    Filesize

                    3.2MB