Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 19:08
Behavioral task
behavioral1
Sample
066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe
Resource
win10v2004-20241007-en
General
-
Target
066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe
-
Size
175KB
-
MD5
ed17f5a962191fa6423599f58efc90c2
-
SHA1
a5186f3e3f96e58ea743408ba24d22df3f3cffee
-
SHA256
066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f
-
SHA512
fb6036ea4c079af2c33749a3cc3619776bb344fe6166ff1b40397916486f87d4568f642988fc67a1f6e12d6735c9ed1c678d8f2961a2f41fffddb212f315f279
-
SSDEEP
3072:U+lBDp+LQ1/fU2RSIIj6hLLYLCYJqvc1DfDTwYhac4IauJX9bj72dm3pRQNQ+Wpv:FD8u/fdRSIIj6hLLYLCYJqvc1DfXwYhY
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot8078461019:AAF9Ui92pCZToAXj8PXw9Sy8x9zcHtYpH2Y/sendMessage?chat_id=7964354947
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/2968-1-0x0000000000F90000-0x0000000000FC2000-memory.dmp family_stormkitty -
Stormkitty family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe File created C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe File opened for modification C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe File created C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe File created C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe File created C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe File created C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe File created C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3036 cmd.exe 4824 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3992 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe Token: SeDebugPrivilege 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3036 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 83 PID 2968 wrote to memory of 3036 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 83 PID 2968 wrote to memory of 3036 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 83 PID 3036 wrote to memory of 3468 3036 cmd.exe 85 PID 3036 wrote to memory of 3468 3036 cmd.exe 85 PID 3036 wrote to memory of 3468 3036 cmd.exe 85 PID 3036 wrote to memory of 4824 3036 cmd.exe 86 PID 3036 wrote to memory of 4824 3036 cmd.exe 86 PID 3036 wrote to memory of 4824 3036 cmd.exe 86 PID 3036 wrote to memory of 4884 3036 cmd.exe 87 PID 3036 wrote to memory of 4884 3036 cmd.exe 87 PID 3036 wrote to memory of 4884 3036 cmd.exe 87 PID 2968 wrote to memory of 4752 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 88 PID 2968 wrote to memory of 4752 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 88 PID 2968 wrote to memory of 4752 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 88 PID 4752 wrote to memory of 4604 4752 cmd.exe 90 PID 4752 wrote to memory of 4604 4752 cmd.exe 90 PID 4752 wrote to memory of 4604 4752 cmd.exe 90 PID 4752 wrote to memory of 452 4752 cmd.exe 91 PID 4752 wrote to memory of 452 4752 cmd.exe 91 PID 4752 wrote to memory of 452 4752 cmd.exe 91 PID 2968 wrote to memory of 3992 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 96 PID 2968 wrote to memory of 3992 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 96 PID 2968 wrote to memory of 3992 2968 066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe"C:\Users\Admin\AppData\Local\Temp\066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:3468
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4824
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
PID:4884
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:4604
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:452
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Local\Temp\066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3992
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3B
MD5f7e6c85504ce6e82442c770f7c8606f0
SHA1572e20738130fddc7c389f2ab14f4e4b22a97c39
SHA2564a8596a7790b5ca9e067da401c018b3206befbcf95c38121854d1a0158e7678a
SHA512db32b88b8a402c67523e819049b708b913c288797bd478305bd57e121bc257a8ebc1bfd24f6e32e8cab66fcdfd1ec8a1f5c4730e5b79d75235aa36f63ffe7969
-
C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\5974d18bed04d14f6a31442d0838ba46\Admin@OZMCVSQS_en-US\System\Process.txt
Filesize4KB
MD5ab40d56fae61ca585194385ce7cf4cbd
SHA170e41f1385a0eca897e4970128f524dcd9f19e96
SHA25624f9992509db86546d5205f48f6cfd77f66be13e847a1336334bda311926b22f
SHA51269456032083d3c5751825b4ad95e009e271204699eb63fdbb2e807eb6bee6736b8b42d36d372fb2ea1f84d3e9a57d741b564521af8e91d07ee15ae6508e0bc74