Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 16:11 UTC

General

  • Target

    setup_installer.exe

  • Size

    1.7MB

  • MD5

    6ec2a541fa04ed26f3ab57062c525df7

  • SHA1

    f282b317e1127a365796abd1946b01abddf28912

  • SHA256

    bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a

  • SHA512

    e44dbf482d4b01b8549b28b8c93ebc53b7f408197a023a2485dd702ed26a65c9667cb96c777c65367dfbff6b0c1eb08cf7e55e7a276281462d60485235eadd73

  • SSDEEP

    24576:wGbopD5a6pYGYamhD5+Pf5tWpd5GMUJx8tY9+2JuSsqSkVQX9rQochzH:dbo95a6iGYr5gfGpd5GMJtYg2HSI4Qo

Malware Config

Extracted

Family

meduza

C2

79.137.202.152

Signatures

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NTFS ADS 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4356
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3632
        • C:\Windows\system32\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4280

Network

  • flag-us
    DNS
    api.ipify.org
    setup_installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.12.205
  • flag-us
    GET
    https://api.ipify.org/
    setup_installer.exe
    Remote address:
    104.26.13.205:443
    Request
    GET / HTTP/1.1
    Accept: text/html; text/plain; */*
    Host: api.ipify.org
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sun, 06 Oct 2024 16:11:19 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8ce6ed362e6863ef-LHR
  • flag-us
    DNS
    c.pki.goog
    setup_installer.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    172.217.169.3
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    setup_installer.exe
    Remote address:
    172.217.169.3:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sun, 06 Oct 2024 15:35:21 GMT
    Expires: Sun, 06 Oct 2024 16:25:21 GMT
    Cache-Control: public, max-age=3000
    Age: 2158
    Last-Modified: Mon, 08 Jul 2024 07:38:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    setup_installer.exe
    Remote address:
    172.217.169.3:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sun, 06 Oct 2024 16:10:15 GMT
    Expires: Sun, 06 Oct 2024 17:00:15 GMT
    Cache-Control: public, max-age=3000
    Age: 64
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    152.202.137.79.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    152.202.137.79.in-addr.arpa
    IN PTR
    Response
    152.202.137.79.in-addr.arpa
    IN PTR
    slow-wrenaezanetwork
  • flag-us
    DNS
    205.13.26.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.13.26.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    98.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    3.169.217.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    3.169.217.172.in-addr.arpa
    IN PTR
    Response
    3.169.217.172.in-addr.arpa
    IN PTR
    lhr25s26-in-f31e100net
  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 79.137.202.152:15666
    setup_installer.exe
    35.4MB
    364.0kB
    26469
    8854
  • 104.26.13.205:443
    https://api.ipify.org/
    tls, http
    setup_installer.exe
    896 B
    3.9kB
    11
    8

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 172.217.169.3:80
    http://c.pki.goog/r/r4.crl
    http
    setup_installer.exe
    556 B
    3.8kB
    7
    5

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 8.8.8.8:53
    api.ipify.org
    dns
    setup_installer.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.13.205
    172.67.74.152
    104.26.12.205

  • 8.8.8.8:53
    c.pki.goog
    dns
    setup_installer.exe
    56 B
    107 B
    1
    1

    DNS Request

    c.pki.goog

    DNS Response

    172.217.169.3

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    152.202.137.79.in-addr.arpa
    dns
    73 B
    109 B
    1
    1

    DNS Request

    152.202.137.79.in-addr.arpa

  • 8.8.8.8:53
    205.13.26.104.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    205.13.26.104.in-addr.arpa

  • 8.8.8.8:53
    98.209.201.84.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    98.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    3.169.217.172.in-addr.arpa
    dns
    72 B
    110 B
    1
    1

    DNS Request

    3.169.217.172.in-addr.arpa

  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    144 B
    146 B
    2
    1

    DNS Request

    212.20.149.52.in-addr.arpa

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
    116 B
    1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

    Filesize

    1.7MB

    MD5

    6ec2a541fa04ed26f3ab57062c525df7

    SHA1

    f282b317e1127a365796abd1946b01abddf28912

    SHA256

    bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a

    SHA512

    e44dbf482d4b01b8549b28b8c93ebc53b7f408197a023a2485dd702ed26a65c9667cb96c777c65367dfbff6b0c1eb08cf7e55e7a276281462d60485235eadd73

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe:a.dll

    Filesize

    1.4MB

    MD5

    a2a6ddf4d883030da40d090f8d12a931

    SHA1

    032b18f318ace3a4d983ec5704b8f42853d2e4a7

    SHA256

    d143310d0bf0a885b85ad7442531718ad4c3972f0ffc30c890cf1dab22e3319d

    SHA512

    2535098b0b2cc40a2fe9a146a92865dda96212bd8559b88ee9c3b56087710ce19ae1453d580f0c90a3e3a721d70ae1e57e2f18323f879ae62dc2dfe905050aed

  • memory/4356-4-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/4356-7-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/4356-10-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/4356-6-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/4356-19-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/4356-20-0x0000000140000000-0x000000014013B000-memory.dmp

    Filesize

    1.2MB

  • memory/4624-9-0x00007FFA23C60000-0x00007FFA23DC4000-memory.dmp

    Filesize

    1.4MB

  • memory/4624-8-0x00007FF7CA9B0000-0x00007FF7CAB65000-memory.dmp

    Filesize

    1.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.