Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/01/2025, 03:45
Behavioral task
behavioral1
Sample
f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe
Resource
win7-20240903-en
General
-
Target
f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe
-
Size
626KB
-
MD5
e4da22458c317595e4bd6712b4728d36
-
SHA1
111a5c4cbd45bced7c04cbeb5192a9afe178865c
-
SHA256
f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd
-
SHA512
b19d9eb5e06834538e8ca5e8655e360b56d63c8ad67441607279c18a848d46a6095b6cbe7019fc79eba784392278e30134e7aef149d0e12964d0b86ecd08dc1d
-
SSDEEP
12288:ROv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPifIl4AbNfoQ+MvFE7v44OzNRlwDmt:Rq5TfcdHj4fmbMo3Jhuv44O5fwY
Malware Config
Extracted
vipkeylogger
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\juvenile.vbs juvenile.exe -
Executes dropped EXE 1 IoCs
pid Process 2680 juvenile.exe -
Loads dropped DLL 1 IoCs
pid Process 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org 8 reallyfreegeoip.org 9 reallyfreegeoip.org -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2772-14-0x0000000000950000-0x0000000000ABA000-memory.dmp autoit_exe behavioral1/memory/2680-32-0x00000000000D0000-0x000000000023A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2680 set thread context of 2692 2680 juvenile.exe 31 -
resource yara_rule behavioral1/memory/2772-0-0x0000000000950000-0x0000000000ABA000-memory.dmp upx behavioral1/files/0x0008000000016d30-9.dat upx behavioral1/memory/2680-16-0x00000000000D0000-0x000000000023A000-memory.dmp upx behavioral1/memory/2772-14-0x0000000000950000-0x0000000000ABA000-memory.dmp upx behavioral1/memory/2680-32-0x00000000000D0000-0x000000000023A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language juvenile.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2692 svchost.exe 2692 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2680 juvenile.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2692 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 2680 juvenile.exe 2680 juvenile.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 2680 juvenile.exe 2680 juvenile.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2680 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 30 PID 2772 wrote to memory of 2680 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 30 PID 2772 wrote to memory of 2680 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 30 PID 2772 wrote to memory of 2680 2772 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 30 PID 2680 wrote to memory of 2692 2680 juvenile.exe 31 PID 2680 wrote to memory of 2692 2680 juvenile.exe 31 PID 2680 wrote to memory of 2692 2680 juvenile.exe 31 PID 2680 wrote to memory of 2692 2680 juvenile.exe 31 PID 2680 wrote to memory of 2692 2680 juvenile.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\thixolabile\juvenile.exe"C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2692
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
626KB
MD5e4da22458c317595e4bd6712b4728d36
SHA1111a5c4cbd45bced7c04cbeb5192a9afe178865c
SHA256f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd
SHA512b19d9eb5e06834538e8ca5e8655e360b56d63c8ad67441607279c18a848d46a6095b6cbe7019fc79eba784392278e30134e7aef149d0e12964d0b86ecd08dc1d