Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
PriceRequest02.10.24.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PriceRequest02.10.24.exe
Resource
win10v2004-20240802-en
General
-
Target
PriceRequest02.10.24.exe
-
Size
713KB
-
MD5
6610e964cc30c9bceb656bef9ac6b16b
-
SHA1
bd3ea2de58a204313e885ed29e476208c29b0c58
-
SHA256
368305c8a62f4edc3ab1b94d1242e5438b7d7c14a6c65f7beb4aad32b1984821
-
SHA512
53ec6cfbbe9a1f29dd17ad435933301ece4289cf7586665127a9e3a209a70d694da4ac233eb77595a0a0c67a0deed6f2daf69358f6d16caf5786ae6a8e678c71
-
SSDEEP
12288:8TvYAq8+JKpCQfpqxczpuai/D58Z4ALL0xyMZhsQAFkOk3PVMDKMgzg:wv9O8CQxqxcz0hg4ALLVWhC3kfVZMgzg
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2016-21-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2016-18-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2016-16-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2016-13-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2016-11-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2668 powershell.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PriceRequest02.10.24.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PriceRequest02.10.24.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PriceRequest02.10.24.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3036 set thread context of 2016 3036 PriceRequest02.10.24.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PriceRequest02.10.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PriceRequest02.10.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3036 PriceRequest02.10.24.exe 3036 PriceRequest02.10.24.exe 2016 PriceRequest02.10.24.exe 2668 powershell.exe 2016 PriceRequest02.10.24.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3036 PriceRequest02.10.24.exe Token: SeDebugPrivilege 2016 PriceRequest02.10.24.exe Token: SeDebugPrivilege 2668 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2668 3036 PriceRequest02.10.24.exe 31 PID 3036 wrote to memory of 2668 3036 PriceRequest02.10.24.exe 31 PID 3036 wrote to memory of 2668 3036 PriceRequest02.10.24.exe 31 PID 3036 wrote to memory of 2668 3036 PriceRequest02.10.24.exe 31 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 PID 3036 wrote to memory of 2016 3036 PriceRequest02.10.24.exe 33 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PriceRequest02.10.24.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PriceRequest02.10.24.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PriceRequest02.10.24.exe"C:\Users\Admin\AppData\Local\Temp\PriceRequest02.10.24.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PriceRequest02.10.24.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Users\Admin\AppData\Local\Temp\PriceRequest02.10.24.exe"C:\Users\Admin\AppData\Local\Temp\PriceRequest02.10.24.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2016
-