Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 14:40

General

  • Target

    BlitzedGrabberV12-main/BlitzedGrabberV12.exe

  • Size

    1.3MB

  • MD5

    50ab1ba628233eacd9df1f88b691e32f

  • SHA1

    a57c3265a98c1ab252b5311da8c176cad99c71fb

  • SHA256

    cffee64da9161e6771e6e40552c378586beed6cf8c8729e21a193cbef9227f41

  • SHA512

    f3ef38967f116b7d8dbc29ce30b44dba9a0f74f72eddcdb8c3e957432a50e40069565a6d5a2e25f0e5502f81a96f84ddc36f53154247c6638c1f10ee0eb956bd

  • SSDEEP

    24576:uSONXaV9x4IUgs36BUI2So5+jnzFoCaGApu8SO00rI:u70T+Sk6BU7HIFo7G98SOFE

Malware Config

Signatures

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12-main\BlitzedGrabberV12.exe
    "C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12-main\BlitzedGrabberV12.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2888
        • C:\Windows\system32\netsh.exe
          netsh wlan show profile
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:2804
        • C:\Windows\system32\findstr.exe
          findstr All
          3⤵
            PID:2760

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\passwords.txt

        Filesize

        1B

        MD5

        68b329da9893e34099c7d8ad5cb9c940

        SHA1

        adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

        SHA256

        01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

        SHA512

        be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

      • memory/1992-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

        Filesize

        4KB

      • memory/1992-1-0x00000000011C0000-0x0000000001310000-memory.dmp

        Filesize

        1.3MB

      • memory/1992-2-0x0000000000260000-0x000000000026A000-memory.dmp

        Filesize

        40KB

      • memory/1992-3-0x0000000000270000-0x000000000028A000-memory.dmp

        Filesize

        104KB

      • memory/1992-4-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

        Filesize

        9.9MB

      • memory/1992-9-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

        Filesize

        4KB

      • memory/1992-17-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

        Filesize

        9.9MB

      • memory/1992-28-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

        Filesize

        9.9MB