Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe
Resource
win10v2004-20240802-en
General
-
Target
b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe
-
Size
1.1MB
-
MD5
9c8abce530cbbd790310a29b3e43acae
-
SHA1
51993d18cf25c9d336c64655ef18849ea3ff27c0
-
SHA256
b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6
-
SHA512
e14addd848815b7b40bf17fa9ecb155e0b745aa6a0ffabea913d9444763511827dcabf32962fb6e8b7ec61f395b7398af6f36fdf53b4fdc4bb068659269b05d8
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLTUoUJ9E0jFcmPLuZ+l7XATt6W:f3v+7/5QLDUzE+JuIlMUW
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 3 IoCs
resource yara_rule behavioral2/memory/2788-12-0x00000000004C0000-0x00000000004F9000-memory.dmp family_snakekeylogger behavioral2/memory/2788-17-0x00000000004C0000-0x00000000004F9000-memory.dmp family_snakekeylogger behavioral2/memory/2788-21-0x00000000004C0000-0x00000000004F9000-memory.dmp family_snakekeylogger -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
pid Process 3360 name.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000700000002345d-5.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3360 set thread context of 2788 3360 name.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1660 2788 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language name.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3360 name.exe 3360 name.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1508 wrote to memory of 3360 1508 b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe 84 PID 1508 wrote to memory of 3360 1508 b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe 84 PID 1508 wrote to memory of 3360 1508 b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe 84 PID 3360 wrote to memory of 2788 3360 name.exe 85 PID 3360 wrote to memory of 2788 3360 name.exe 85 PID 3360 wrote to memory of 2788 3360 name.exe 85 PID 3360 wrote to memory of 2788 3360 name.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe"C:\Users\Admin\AppData\Local\Temp\b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6.exe"3⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 4004⤵
- Program crash
PID:1660
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2788 -ip 27881⤵PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD59c8abce530cbbd790310a29b3e43acae
SHA151993d18cf25c9d336c64655ef18849ea3ff27c0
SHA256b1fd45ab9653b2ccab7e6c9867acd8e880f80b4e55425347321d39927cd726a6
SHA512e14addd848815b7b40bf17fa9ecb155e0b745aa6a0ffabea913d9444763511827dcabf32962fb6e8b7ec61f395b7398af6f36fdf53b4fdc4bb068659269b05d8