Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2024, 02:08 UTC

General

  • Target

    156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12.exe

  • Size

    2.0MB

  • MD5

    240f8d86f2944d328bb9114faba27da6

  • SHA1

    69aa2bb22773ff4ed93f0124fd5d3b6954399b70

  • SHA256

    156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12

  • SHA512

    55dd2d2d2445baf7d19a6b1d296e02789a0f263dd78f1e58715ffe8801320ba54b0559f4f59597498ad876a1bdf0537c3f73616e8ca64dd4b6a99882d40c8835

  • SSDEEP

    49152:S+b7vTkIpaBDB/J/k2luVnY77P/hwUave8a2GS4GJFHl:V7vTkIIBBzwnY7S5a2GDMB

Malware Config

Extracted

Family

stealc

Botnet

tale

C2

http://185.215.113.206

Attributes
  • url_path

    /6c4adf523b719729.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12.exe
    "C:\Users\Admin\AppData\Local\Temp\156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1372

Network

  • flag-ru
    GET
    http://185.215.113.206/
    156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12.exe
    Remote address:
    185.215.113.206:80
    Request
    GET / HTTP/1.1
    Host: 185.215.113.206
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Wed, 06 Nov 2024 02:08:06 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-ru
    POST
    http://185.215.113.206/6c4adf523b719729.php
    156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12.exe
    Remote address:
    185.215.113.206:80
    Request
    POST /6c4adf523b719729.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID
    Host: 185.215.113.206
    Content-Length: 210
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Wed, 06 Nov 2024 02:08:06 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 8
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • 185.215.113.206:80
    http://185.215.113.206/6c4adf523b719729.php
    http
    156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12.exe
    726 B
    625 B
    5
    5

    HTTP Request

    GET http://185.215.113.206/

    HTTP Response

    200

    HTTP Request

    POST http://185.215.113.206/6c4adf523b719729.php

    HTTP Response

    200
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1372-0-0x0000000001350000-0x0000000001A7D000-memory.dmp

    Filesize

    7.2MB

  • memory/1372-1-0x0000000077670000-0x0000000077672000-memory.dmp

    Filesize

    8KB

  • memory/1372-3-0x0000000001350000-0x0000000001A7D000-memory.dmp

    Filesize

    7.2MB

  • memory/1372-2-0x0000000001351000-0x00000000013B9000-memory.dmp

    Filesize

    416KB

  • memory/1372-5-0x0000000001350000-0x0000000001A7D000-memory.dmp

    Filesize

    7.2MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.