Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 11:08 UTC

General

  • Target

    setup.7.0.exe

  • Size

    1.7MB

  • MD5

    994bb906f5c652d50b21a45c76c530c1

  • SHA1

    ad90263d8b82f065a56efc728f6e226a60196792

  • SHA256

    1a471d692acc84510b6af7c3ca4953823177bd4af8b569480a7e0862f88587e0

  • SHA512

    6a99872d9884a1d609f984038fb661ac4e44608591d14cdb76741ecbb9bd5bfb6d1edb9f07c45865837502bc6b5dee74947179dd1eb38a4d7c1f7b2a30ca139c

  • SSDEEP

    49152:7bo95a6iGYm/aY3NZd7LcwSrhn8SjWoCu:w/n7LyhZjWoCu

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NTFS ADS 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe
      "C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2492
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\Windows\system32\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1788

Network

  • flag-us
    DNS
    api.ipify.org
    setup.7.0.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    104.26.12.205
  • flag-us
    GET
    https://api.ipify.org/
    setup.7.0.exe
    Remote address:
    172.67.74.152:443
    Request
    GET / HTTP/1.1
    Accept: text/html; text/plain; */*
    Host: api.ipify.org
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sun, 06 Oct 2024 11:08:17 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8ce531505e39cd14-LHR
  • flag-us
    DNS
    c.pki.goog
    setup.7.0.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    172.217.169.3
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    setup.7.0.exe
    Remote address:
    172.217.169.3:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sun, 06 Oct 2024 10:35:21 GMT
    Expires: Sun, 06 Oct 2024 11:25:21 GMT
    Cache-Control: public, max-age=3000
    Age: 1976
    Last-Modified: Mon, 08 Jul 2024 07:38:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    setup.7.0.exe
    Remote address:
    172.217.169.3:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sun, 06 Oct 2024 10:20:15 GMT
    Expires: Sun, 06 Oct 2024 11:10:15 GMT
    Cache-Control: public, max-age=3000
    Age: 2882
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    162.181.107.109.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    162.181.107.109.in-addr.arpa
    IN PTR
    Response
    162.181.107.109.in-addr.arpa
    IN PTR
    deluxe-quicksandaezanetwork
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    152.74.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    152.74.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    3.169.217.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    3.169.217.172.in-addr.arpa
    IN PTR
    Response
    3.169.217.172.in-addr.arpa
    IN PTR
    lhr25s26-in-f31e100net
  • flag-us
    DNS
    138.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    29.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 109.107.181.162:15666
    setup.7.0.exe
    12.8MB
    136.5kB
    9551
    2674
  • 172.67.74.152:443
    https://api.ipify.org/
    tls, http
    setup.7.0.exe
    896 B
    3.9kB
    11
    8

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 172.217.169.3:80
    http://c.pki.goog/r/r4.crl
    http
    setup.7.0.exe
    556 B
    3.8kB
    7
    5

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 8.8.8.8:53
    api.ipify.org
    dns
    setup.7.0.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    172.67.74.152
    104.26.13.205
    104.26.12.205

  • 8.8.8.8:53
    c.pki.goog
    dns
    setup.7.0.exe
    56 B
    107 B
    1
    1

    DNS Request

    c.pki.goog

    DNS Response

    172.217.169.3

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    162.181.107.109.in-addr.arpa
    dns
    74 B
    117 B
    1
    1

    DNS Request

    162.181.107.109.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    152.74.67.172.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    152.74.67.172.in-addr.arpa

  • 8.8.8.8:53
    3.169.217.172.in-addr.arpa
    dns
    72 B
    110 B
    1
    1

    DNS Request

    3.169.217.172.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    138.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    138.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    29.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    29.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe

    Filesize

    1.7MB

    MD5

    994bb906f5c652d50b21a45c76c530c1

    SHA1

    ad90263d8b82f065a56efc728f6e226a60196792

    SHA256

    1a471d692acc84510b6af7c3ca4953823177bd4af8b569480a7e0862f88587e0

    SHA512

    6a99872d9884a1d609f984038fb661ac4e44608591d14cdb76741ecbb9bd5bfb6d1edb9f07c45865837502bc6b5dee74947179dd1eb38a4d7c1f7b2a30ca139c

  • C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe:a.dll

    Filesize

    1.4MB

    MD5

    7174024be7da44564fb982f235475e91

    SHA1

    e85017e81251e3b4463c63657af78c4fd6166032

    SHA256

    68c07fa0a1704dc6465f6eac11c24b9c018a7c4c9a182613c69c29f70ead91bb

    SHA512

    e03535c0b22c1ab80f2a6463dbdfe7d34d5e6fbb3a865436c93abc5046faefc1f227a7280315825331d6b237e9bf3a1134339689599e6577530f87bf0a013b3a

  • memory/2492-6-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/2492-10-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/2492-7-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/2492-4-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/2492-17-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/3168-9-0x00007FFE5F830000-0x00007FFE5F994000-memory.dmp

    Filesize

    1.4MB

  • memory/3168-8-0x00007FF75FC70000-0x00007FF75FE25000-memory.dmp

    Filesize

    1.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.