Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe
Resource
win7-20240708-en
General
-
Target
056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe
-
Size
6.0MB
-
MD5
0f6e6055e4dd7ea872cc0651126e580d
-
SHA1
1a275016c1fd5290440f0586468e687f8e2f16eb
-
SHA256
056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636
-
SHA512
cc3581243e6f1202ed65fbc4a3f93a6168896d272b048e9a1eacf92410237c7a26acbfbf78f64ab0e15f297815b2f75604b3bdea25af5a271485295739209178
-
SSDEEP
49152:etE5w7bRXITO0dECZ+HCModqI6bgljkiz6QggxVJV7SzjIgQ45pqG2mfv/vs85lG:F8bFHsEagi4XgjZjTxx7
Malware Config
Signatures
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
resource yara_rule behavioral1/memory/2916-0-0x0000000069CC0000-0x000000006A377000-memory.dmp family_cryptbot_v3 -
Executes dropped EXE 6 IoCs
pid Process 2736 service123.exe 236 service123.exe 912 service123.exe 944 service123.exe 980 service123.exe 2216 service123.exe -
Loads dropped DLL 8 IoCs
pid Process 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 2736 service123.exe 236 service123.exe 912 service123.exe 944 service123.exe 980 service123.exe 2216 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2580 schtasks.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2736 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 30 PID 2916 wrote to memory of 2736 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 30 PID 2916 wrote to memory of 2736 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 30 PID 2916 wrote to memory of 2736 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 30 PID 2916 wrote to memory of 2580 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 31 PID 2916 wrote to memory of 2580 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 31 PID 2916 wrote to memory of 2580 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 31 PID 2916 wrote to memory of 2580 2916 056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe 31 PID 3048 wrote to memory of 236 3048 taskeng.exe 34 PID 3048 wrote to memory of 236 3048 taskeng.exe 34 PID 3048 wrote to memory of 236 3048 taskeng.exe 34 PID 3048 wrote to memory of 236 3048 taskeng.exe 34 PID 3048 wrote to memory of 912 3048 taskeng.exe 35 PID 3048 wrote to memory of 912 3048 taskeng.exe 35 PID 3048 wrote to memory of 912 3048 taskeng.exe 35 PID 3048 wrote to memory of 912 3048 taskeng.exe 35 PID 3048 wrote to memory of 944 3048 taskeng.exe 36 PID 3048 wrote to memory of 944 3048 taskeng.exe 36 PID 3048 wrote to memory of 944 3048 taskeng.exe 36 PID 3048 wrote to memory of 944 3048 taskeng.exe 36 PID 3048 wrote to memory of 980 3048 taskeng.exe 37 PID 3048 wrote to memory of 980 3048 taskeng.exe 37 PID 3048 wrote to memory of 980 3048 taskeng.exe 37 PID 3048 wrote to memory of 980 3048 taskeng.exe 37 PID 3048 wrote to memory of 2216 3048 taskeng.exe 38 PID 3048 wrote to memory of 2216 3048 taskeng.exe 38 PID 3048 wrote to memory of 2216 3048 taskeng.exe 38 PID 3048 wrote to memory of 2216 3048 taskeng.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe"C:\Users\Admin\AppData\Local\Temp\056b17b02a26dd4a260222dc061c4050d57a0cd708ba448b286715002e1fd636.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2580
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {76C39087-7A55-457E-ACFC-E91CD5FC508C} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216
-