Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
HESAP DETAYLARI.pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HESAP DETAYLARI.pdf.exe
Resource
win10v2004-20241007-en
General
-
Target
HESAP DETAYLARI.pdf.exe
-
Size
598KB
-
MD5
b040e5d5e8022359da5c465ad3e2dcf1
-
SHA1
f6f7f65784a00c22c478ef578c7b47c716997a60
-
SHA256
38e3fa1e0a5550df5117b64b4971d6d7ce187519d26e5d87abe7b8f949de3f10
-
SHA512
86d700f48a88153ce075688c671667be905f5f0343e8b7b95c56d8292fb7536e1c1cb36788650dfca174489ccd7ce3f5a2d5cdd67b3cb093f6d5bb69447a41cf
-
SSDEEP
12288:Ncir1S2IoOAc6/5rZGmy45nZZno/59/qVcVApPstz2ug/K7bNcKTwwxp6H2dOWqp:JnZ9oqcapEtz2Z/K7b+awwa2db0
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2568-23-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2568-29-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2568-30-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2568-28-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2568-25-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2740 powershell.exe 344 powershell.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HESAP DETAYLARI.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HESAP DETAYLARI.pdf.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HESAP DETAYLARI.pdf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1016 set thread context of 2568 1016 HESAP DETAYLARI.pdf.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HESAP DETAYLARI.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HESAP DETAYLARI.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2884 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1016 HESAP DETAYLARI.pdf.exe 1016 HESAP DETAYLARI.pdf.exe 2568 HESAP DETAYLARI.pdf.exe 344 powershell.exe 2740 powershell.exe 2568 HESAP DETAYLARI.pdf.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1016 HESAP DETAYLARI.pdf.exe Token: SeDebugPrivilege 2568 HESAP DETAYLARI.pdf.exe Token: SeDebugPrivilege 2740 powershell.exe Token: SeDebugPrivilege 344 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1016 wrote to memory of 344 1016 HESAP DETAYLARI.pdf.exe 31 PID 1016 wrote to memory of 344 1016 HESAP DETAYLARI.pdf.exe 31 PID 1016 wrote to memory of 344 1016 HESAP DETAYLARI.pdf.exe 31 PID 1016 wrote to memory of 344 1016 HESAP DETAYLARI.pdf.exe 31 PID 1016 wrote to memory of 2740 1016 HESAP DETAYLARI.pdf.exe 33 PID 1016 wrote to memory of 2740 1016 HESAP DETAYLARI.pdf.exe 33 PID 1016 wrote to memory of 2740 1016 HESAP DETAYLARI.pdf.exe 33 PID 1016 wrote to memory of 2740 1016 HESAP DETAYLARI.pdf.exe 33 PID 1016 wrote to memory of 2884 1016 HESAP DETAYLARI.pdf.exe 35 PID 1016 wrote to memory of 2884 1016 HESAP DETAYLARI.pdf.exe 35 PID 1016 wrote to memory of 2884 1016 HESAP DETAYLARI.pdf.exe 35 PID 1016 wrote to memory of 2884 1016 HESAP DETAYLARI.pdf.exe 35 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 PID 1016 wrote to memory of 2568 1016 HESAP DETAYLARI.pdf.exe 37 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HESAP DETAYLARI.pdf.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 HESAP DETAYLARI.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HESAP DETAYLARI.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HESAP DETAYLARI.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HESAP DETAYLARI.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:344
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WiEGDhYdY.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WiEGDhYdY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA4.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\HESAP DETAYLARI.pdf.exe"C:\Users\Admin\AppData\Local\Temp\HESAP DETAYLARI.pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52e34556ca6521205493c8e8a88bda753
SHA183a1aced38f8be0b086fbeff32f3d5e7a7affae0
SHA2560014467d234e5d9977775aa46910cf1cc433cb6f2c6c835a254dafa506292edc
SHA5125e648577176a4623c64abf619b94cbec78a419063c113bfc8cde7a37898e26a680020dda9abd1f35dae39a867900a040f219073045ff99da6f1c4d8d533f1e10
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD525262830293d6577c99c4b5a783b6c98
SHA1bc81f59641aaad725a9e3e2f5e4d40f2aeed1f10
SHA256b2b583fce55279bff26c2dadc4864e7a195633d307f303fbf076ba2772d22baa
SHA512f126bcaf847b1c56174b68097b85d9ff48e6fa34a6334a248b5d951a29e200e3b4ee1fac098383305e9e1797197df153f24e8bbc26361b669bb63635fd38dd15