Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
malw.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
malw.exe
Resource
win10v2004-20241007-en
General
-
Target
malw.exe
-
Size
662KB
-
MD5
fd1c8a844272f22a0d5e01b667d4f91b
-
SHA1
92011d2ef6296463333b422df02ff59e0126a6c5
-
SHA256
b4a6a7b4e3b8285d232df5e5d3a3d6ba8474c13afc59086b1267d737c5052a03
-
SHA512
09a5db494b9ecf4234690643545e948418e3a8a3107e4ebe6027e13f09c1cebf9f332f94689809420d84fc1666bd7b6422ac4ac50efa20861d34f73395b93b4a
-
SSDEEP
12288:k2QJ9o2sW3B9o2G2/6SkwwOeO01ZAao2tezqrVcO5sZYw6bhyWjX53XOo:kv9o2sW3B9oV2iSkwwOe/U2HVcaNhyaf
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.securemail.pro - Port:
587 - Username:
[email protected] - Password:
jrpM0Y5k - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
resource yara_rule behavioral2/memory/1660-77-0x0000000000B00000-0x0000000001D54000-memory.dmp family_snakekeylogger behavioral2/memory/1660-78-0x0000000000B00000-0x0000000000B26000-memory.dmp family_snakekeylogger -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1188 powershell.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
Blocklisted process makes network request 7 IoCs
flow pid Process 20 1660 msiexec.exe 22 1660 msiexec.exe 24 1660 msiexec.exe 26 1660 msiexec.exe 28 1660 msiexec.exe 40 1660 msiexec.exe 44 1660 msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 20 drive.google.com 19 drive.google.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 39 checkip.dyndns.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1660 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1188 powershell.exe 1660 msiexec.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\Macroblast\affejendes.tid malw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language malw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1188 powershell.exe 1660 msiexec.exe 1660 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1188 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 1188 powershell.exe Token: SeIncreaseQuotaPrivilege 1188 powershell.exe Token: SeSecurityPrivilege 1188 powershell.exe Token: SeTakeOwnershipPrivilege 1188 powershell.exe Token: SeLoadDriverPrivilege 1188 powershell.exe Token: SeSystemProfilePrivilege 1188 powershell.exe Token: SeSystemtimePrivilege 1188 powershell.exe Token: SeProfSingleProcessPrivilege 1188 powershell.exe Token: SeIncBasePriorityPrivilege 1188 powershell.exe Token: SeCreatePagefilePrivilege 1188 powershell.exe Token: SeBackupPrivilege 1188 powershell.exe Token: SeRestorePrivilege 1188 powershell.exe Token: SeShutdownPrivilege 1188 powershell.exe Token: SeDebugPrivilege 1188 powershell.exe Token: SeSystemEnvironmentPrivilege 1188 powershell.exe Token: SeRemoteShutdownPrivilege 1188 powershell.exe Token: SeUndockPrivilege 1188 powershell.exe Token: SeManageVolumePrivilege 1188 powershell.exe Token: 33 1188 powershell.exe Token: 34 1188 powershell.exe Token: 35 1188 powershell.exe Token: 36 1188 powershell.exe Token: SeDebugPrivilege 1660 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1188 1648 malw.exe 86 PID 1648 wrote to memory of 1188 1648 malw.exe 86 PID 1648 wrote to memory of 1188 1648 malw.exe 86 PID 1188 wrote to memory of 1660 1188 powershell.exe 92 PID 1188 wrote to memory of 1660 1188 powershell.exe 92 PID 1188 wrote to memory of 1660 1188 powershell.exe 92 PID 1188 wrote to memory of 1660 1188 powershell.exe 92 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\malw.exe"C:\Users\Admin\AppData\Local\Temp\malw.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Appeachment=Get-Content -raw 'C:\Users\Admin\AppData\Local\downrange\Stutteriers\samfrdselen\Sharpness.Kon';$Oplandsavises=$Appeachment.SubString(12242,3);.$Oplandsavises($Appeachment)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\syswow64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
54KB
MD5a455a44aa414354fe74ee543bbf64451
SHA14d73664950e0b77b2f05eebce4e5c3d549cc18ea
SHA256c7dac58dcad45abf34bee7c7567a746fada583c0e734d204ed2f71617c4b7b31
SHA512a9bedcaa864985c0ec2f9eb521983d23f7b58689922f39305d17fa39aa41ef02be8bec3fc99d22caba1c34c56d6d68160f9dea27bc207eda83f97cc47f852fa7
-
Filesize
321KB
MD554daa56b551e061fb6f1295ef32a374e
SHA1250f5859827f66cd522d04cdffa3829dbd933425
SHA2569ad1e96273abfee679b731db48243a170704a4934c5d3f17d4c2d3c796af61c1
SHA5120a5741e91597af9f88364db27494b44a087c3527ee9b643d5fe3b3f23687e3580c8d847a5e53d99933c06bfdfd3a665e3334fab8a93e00d6b7edfb28e717e6c1