Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07/12/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe
Resource
win10v2004-20241007-en
General
-
Target
84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe
-
Size
3.2MB
-
MD5
2c77167cb50d52d86c89c811dcf6fa11
-
SHA1
d8254a4d39f1effa97cfca5e211f7da8fa83a350
-
SHA256
84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1
-
SHA512
f2eed2831955b8b46585ac916bf2d2326a9c1c6a146a630c25ad06dfc334adcfc247461698f767585cd61c6d401e51c5e7f3b5f8f29777752c1776d409065eb7
-
SSDEEP
24576:S/frmzI7lsX7Rh7lmXh0lhSMXlWuQXRnEDRZ58WfR2u7XNfs9mMlkcI:KfrmzI7OXBGuQXdENZ552u7dfjEk
Malware Config
Extracted
meduza
45.130.145.152
-
anti_dbg
true
-
anti_vm
true
-
build_name
Oxoxox
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
-
grabber_max_size
3.145728e+06
-
port
15666
-
self_destruct
true
Signatures
-
Meduza Stealer payload 46 IoCs
resource yara_rule behavioral1/memory/2144-10-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-8-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-6-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-14-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-16-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-12-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-11-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-7-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-4-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-3-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-2-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-9-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-1-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-26-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-33-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-37-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-36-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-35-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-32-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-42-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-71-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-67-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-66-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-62-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-78-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-77-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-75-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-74-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-61-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-57-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-56-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-52-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-51-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-49-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-47-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-46-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-44-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-73-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-41-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-39-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-38-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-31-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-30-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-29-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-27-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza behavioral1/memory/2144-81-0x0000000001BC0000-0x0000000001DBA000-memory.dmp family_meduza -
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\International\Geo\Nation 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 5 api.ipify.org -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1484 cmd.exe 2768 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2768 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2144 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2144 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe Token: SeImpersonatePrivilege 2144 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2144 wrote to memory of 1484 2144 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe 31 PID 2144 wrote to memory of 1484 2144 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe 31 PID 2144 wrote to memory of 1484 2144 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe 31 PID 1484 wrote to memory of 2768 1484 cmd.exe 33 PID 1484 wrote to memory of 2768 1484 cmd.exe 33 PID 1484 wrote to memory of 2768 1484 cmd.exe 33 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe"C:\Users\Admin\AppData\Local\Temp\84aa07448596dc7dca2a967c27ca977b81de61164cadba5329992e4b8b35c5b1.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2144 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q ""2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 30003⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1