Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 07:20

General

  • Target

    malw.exe

  • Size

    662KB

  • MD5

    fd1c8a844272f22a0d5e01b667d4f91b

  • SHA1

    92011d2ef6296463333b422df02ff59e0126a6c5

  • SHA256

    b4a6a7b4e3b8285d232df5e5d3a3d6ba8474c13afc59086b1267d737c5052a03

  • SHA512

    09a5db494b9ecf4234690643545e948418e3a8a3107e4ebe6027e13f09c1cebf9f332f94689809420d84fc1666bd7b6422ac4ac50efa20861d34f73395b93b4a

  • SSDEEP

    12288:k2QJ9o2sW3B9o2G2/6SkwwOeO01ZAao2tezqrVcO5sZYw6bhyWjX53XOo:kv9o2sW3B9oV2iSkwwOe/U2HVcaNhyaf

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\malw.exe
    "C:\Users\Admin\AppData\Local\Temp\malw.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Appeachment=Get-Content -raw 'C:\Users\Admin\AppData\Local\downrange\Stutteriers\samfrdselen\Sharpness.Kon';$Oplandsavises=$Appeachment.SubString(12242,3);.$Oplandsavises($Appeachment)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\syswow64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k5qs22pq.0fe.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\downrange\Stutteriers\samfrdselen\Sharpness.Kon

    Filesize

    54KB

    MD5

    a455a44aa414354fe74ee543bbf64451

    SHA1

    4d73664950e0b77b2f05eebce4e5c3d549cc18ea

    SHA256

    c7dac58dcad45abf34bee7c7567a746fada583c0e734d204ed2f71617c4b7b31

    SHA512

    a9bedcaa864985c0ec2f9eb521983d23f7b58689922f39305d17fa39aa41ef02be8bec3fc99d22caba1c34c56d6d68160f9dea27bc207eda83f97cc47f852fa7

  • C:\Users\Admin\AppData\Local\downrange\Stutteriers\samfrdselen\Unremorsefulness.Ska

    Filesize

    321KB

    MD5

    54daa56b551e061fb6f1295ef32a374e

    SHA1

    250f5859827f66cd522d04cdffa3829dbd933425

    SHA256

    9ad1e96273abfee679b731db48243a170704a4934c5d3f17d4c2d3c796af61c1

    SHA512

    0a5741e91597af9f88364db27494b44a087c3527ee9b643d5fe3b3f23687e3580c8d847a5e53d99933c06bfdfd3a665e3334fab8a93e00d6b7edfb28e717e6c1

  • memory/1188-46-0x0000000007030000-0x000000000703A000-memory.dmp

    Filesize

    40KB

  • memory/1188-31-0x0000000070520000-0x000000007056C000-memory.dmp

    Filesize

    304KB

  • memory/1188-10-0x00000000053E0000-0x0000000005446000-memory.dmp

    Filesize

    408KB

  • memory/1188-11-0x0000000005450000-0x00000000054B6000-memory.dmp

    Filesize

    408KB

  • memory/1188-7-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-21-0x00000000054C0000-0x0000000005814000-memory.dmp

    Filesize

    3.3MB

  • memory/1188-22-0x0000000005A90000-0x0000000005AAE000-memory.dmp

    Filesize

    120KB

  • memory/1188-23-0x0000000005B20000-0x0000000005B6C000-memory.dmp

    Filesize

    304KB

  • memory/1188-24-0x0000000005FE0000-0x0000000006076000-memory.dmp

    Filesize

    600KB

  • memory/1188-25-0x0000000005F90000-0x0000000005FAA000-memory.dmp

    Filesize

    104KB

  • memory/1188-26-0x0000000006080000-0x00000000060A2000-memory.dmp

    Filesize

    136KB

  • memory/1188-27-0x00000000072D0000-0x0000000007874000-memory.dmp

    Filesize

    5.6MB

  • memory/1188-8-0x0000000004DB0000-0x00000000053D8000-memory.dmp

    Filesize

    6.2MB

  • memory/1188-49-0x00000000071E0000-0x0000000007204000-memory.dmp

    Filesize

    144KB

  • memory/1188-32-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-48-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-30-0x0000000006EC0000-0x0000000006EF2000-memory.dmp

    Filesize

    200KB

  • memory/1188-33-0x0000000070690000-0x00000000709E4000-memory.dmp

    Filesize

    3.3MB

  • memory/1188-44-0x0000000006F30000-0x0000000006FD3000-memory.dmp

    Filesize

    652KB

  • memory/1188-43-0x0000000006F00000-0x0000000006F1E000-memory.dmp

    Filesize

    120KB

  • memory/1188-45-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-5-0x000000007409E000-0x000000007409F000-memory.dmp

    Filesize

    4KB

  • memory/1188-9-0x0000000004BB0000-0x0000000004BD2000-memory.dmp

    Filesize

    136KB

  • memory/1188-47-0x00000000071B0000-0x00000000071DA000-memory.dmp

    Filesize

    168KB

  • memory/1188-29-0x0000000007F00000-0x000000000857A000-memory.dmp

    Filesize

    6.5MB

  • memory/1188-50-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-53-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-52-0x000000007409E000-0x000000007409F000-memory.dmp

    Filesize

    4KB

  • memory/1188-54-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-6-0x0000000000CE0000-0x0000000000D16000-memory.dmp

    Filesize

    216KB

  • memory/1188-56-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-57-0x0000000008580000-0x000000000D44A000-memory.dmp

    Filesize

    78.8MB

  • memory/1188-58-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-59-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-60-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-61-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1188-63-0x0000000074090000-0x0000000074840000-memory.dmp

    Filesize

    7.7MB

  • memory/1660-76-0x0000000000B00000-0x0000000001D54000-memory.dmp

    Filesize

    18.3MB

  • memory/1660-77-0x0000000000B00000-0x0000000001D54000-memory.dmp

    Filesize

    18.3MB

  • memory/1660-78-0x0000000000B00000-0x0000000000B26000-memory.dmp

    Filesize

    152KB

  • memory/1660-79-0x0000000024540000-0x00000000245DC000-memory.dmp

    Filesize

    624KB

  • memory/1660-80-0x00000000249D0000-0x0000000024A20000-memory.dmp

    Filesize

    320KB

  • memory/1660-81-0x0000000025270000-0x0000000025432000-memory.dmp

    Filesize

    1.8MB

  • memory/1660-82-0x00000000250A0000-0x0000000025132000-memory.dmp

    Filesize

    584KB

  • memory/1660-83-0x0000000024A20000-0x0000000024A2A000-memory.dmp

    Filesize

    40KB