Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 01:38 UTC
Static task
static1
Behavioral task
behavioral1
Sample
5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe
Resource
win10v2004-20241007-en
General
-
Target
5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe
-
Size
1.0MB
-
MD5
a5b62d982db9a3841c9c3f381f25146e
-
SHA1
f9c714ccd984e7f7bfef5964ae761b968ee74828
-
SHA256
5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8
-
SHA512
5fe9b5cf77939688aa62713941d1bc4c419d1d4442d154bae03f4e950798a4772cd4396efba4e55f5d6f3baacf1f8fbf7ca9125dd4223c40ff5e1ad951f0fd25
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaajQr1zoxHHLlI62zZbZVz:mJZoQrbTFZY1iaiEoZ0VDz
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.al-subai.com - Port:
587 - Username:
asadek@al-subai.com - Password:
A_Sadek1962 - Email To:
daniellahm@yandex.com
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 3 IoCs
resource yara_rule behavioral1/memory/2336-3-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2336-7-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2336-5-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2136 set thread context of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2336 RegSvcs.exe 2336 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2336 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 PID 2136 wrote to memory of 2336 2136 5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe"C:\Users\Admin\AppData\Local\Temp\5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\5c73d9378bca7a5eecefe91b7999cae483e2aa31ee49f46b21d6c97a7eabaad8.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2336
-
Network
-
Remote address:8.8.8.8:53Requestcheckip.dyndns.orgIN AResponsecheckip.dyndns.orgIN CNAMEcheckip.dyndns.comcheckip.dyndns.comIN A193.122.6.168checkip.dyndns.comIN A132.226.8.169checkip.dyndns.comIN A132.226.247.73checkip.dyndns.comIN A158.101.44.242checkip.dyndns.comIN A193.122.130.0
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 2df0d0e3659645063a8edcf9de9ce4ba
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 0fa5495ce27070068cc91f04e29017dd
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 378c7f7c1746a1338c8107bcd27cd492
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 77ac6da9504f58838f875637a7c6abe8
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 0825ca8d92d91a7fb93c0041fc70124d
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: ead97a39ab05fec902db0a8d49141635
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 53d494ebe303b7cc538fc6ef2755b929
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: 5f8d8e23f8b4597416ed5b4e6574805b
-
Remote address:193.122.6.168:80RequestGET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Host: checkip.dyndns.org
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 105
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
X-Request-ID: d67ce96b3c18210c0afb1438152ba083
-
Remote address:8.8.8.8:53Requestreallyfreegeoip.orgIN AResponsereallyfreegeoip.orgIN A104.21.67.152reallyfreegeoip.orgIN A172.67.177.134
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31039
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hKWuqWH2ldAvPEvtEt%2F3yVKXWhP8EFhJiathxiRjaVOkqPRY6E%2F%2F%2BGaTPkv2c2SvhHo3OxQf6bdDmJmtN4Edwaq4D442cnUCKw9wCn6DP%2Bpdp0KhfeQKOP4K%2FfHx8WHEb8tiuPmw"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa799cb089442-LHR
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31042
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4UNa%2Fnbtzg%2F3veVXiCtfJV4taz5LybhpPiJ9Bu4iFUrORYl0NQZUBWp%2BOMMbIALBgxDRBckq599WtRIVLt%2BDAGixDjpqIHWj1g%2BWrSriLexRwwOHK7XZOATl5wOAyH32Ltjtwk9Z"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa7aabc619442-LHR
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31044
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O14NIuLFr6frBE3jWQeVddKzNGKZdF6Gy7l7jXkUP8aWIptjrsqdg5RAr%2FaIwi0L8RosK8hFZC81HRQyarJmuURmmSu6%2BJaXjH7MDG7jFO8fd%2F57zXjYUl1BqiKFaWddbbh8XV8o"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa7bbae9e9442-LHR
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31047
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w9F5PHdgND2V26wCDcqHAnjawdAbw7F7IrlGiq3%2By5Gfb%2B0B645WLk2os74s76R%2FL61ZQwi5p%2F36nDyPCIe9Q%2BIlnMfWgmWbygneWH4n1nqWQ2wVLwtOsbcm9lDBwh5jAmcnSenR"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa7cca8699442-LHR
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31050
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tmrDCMwVzguuATycLMPz%2FiTd3RB1FVRkfP0B4ndp%2BQrHKM%2Feg2uLgak9xe2KnY4EJ%2F6WvpdRj0K1FAR%2F7WCZfzv3ZzFZ8Fpfx0MZdsRfjLfTGpuDj1vUDGHGwuq2T688hCd2oT6l"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa7dd9afb9442-LHR
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31052
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qHYNr77J76j2vDKl44NkaHsHRtdDj5D%2BTp1yLJ%2Ff04fRtFzmwUjI4KjNS%2F5puwcxzwFzaI2InSfkV9t7CBQFF7lEnKJMC4OuzLQYVf6xUvqc2a%2BqHJvBnM%2FG%2BTg6%2Fc%2BYpA4YiZJ8"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa7ee8f6c9442-LHR
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31055
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FKhJlZcRAc6fDw3Rb8HBG155Wf3edMsBTwSYjXfUrVJFsSva43s4HVrDBfkjCCPqHIasRwWsrpR1BS8sEkrvcstQ8Bik3n0vTQlzZtMDISFkmKolSt5j71pVpBKwM26Y44jb1Wir"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa7ff8a629442-LHR
-
Remote address:104.21.67.152:443RequestGET /xml/138.199.29.44 HTTP/1.1
Host: reallyfreegeoip.org
ResponseHTTP/1.1 200 OK
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
access-control-allow-origin: *
vary: Accept-Encoding
Cache-Control: max-age=86400
CF-Cache-Status: HIT
Age: 31058
Last-Modified: Tue, 08 Oct 2024 17:01:44 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8%2Fep1WYhbazvLvR4CN7dox0tsMHcdZrLAFZ0BfwNApauoAI9Dhk8nuNIvRYPKvj8Tk50YcvyJym%2BeN%2F3m6XswB3aSANoe2B0jhYvDCrBeMgWZzGxQfZpJ22%2BUNqPHlapNYA%2BfWRj"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cfaa8107e009442-LHR
-
2.6kB 6.7kB 31 22
HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200HTTP Request
GET http://checkip.dyndns.org/HTTP Response
200 -
2.1kB 12.3kB 23 23
HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200HTTP Request
GET https://reallyfreegeoip.org/xml/138.199.29.44HTTP Response
200
-
64 B 176 B 1 1
DNS Request
checkip.dyndns.org
DNS Response
193.122.6.168132.226.8.169132.226.247.73158.101.44.242193.122.130.0
-
65 B 97 B 1 1
DNS Request
reallyfreegeoip.org
DNS Response
104.21.67.152172.67.177.134