Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/01/2025, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe
Resource
win10v2004-20241007-en
General
-
Target
611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe
-
Size
997KB
-
MD5
ba6582876c5e9697840b20325ff120d0
-
SHA1
f5a9ce06138224b27b9eb13bc258859acb177b99
-
SHA256
611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5
-
SHA512
fcafcb8c95414a41f5b3f0e7c80cd326e3ef84147af1adf7965a3f3fa236163e802c85508e0afcbf103777f7a9d3309d29928d8adc3ac5ca43e5bca39d81c59b
-
SSDEEP
12288:ALkcoxg7v3qnC11ErwIhh0F4qwUgUny5QYEAmD4oESIFTYrgxtATG/PnaFLIont4:WfmMv6Ckr7Mny5QYjBcrbG/PFZUcW6L
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.zarlynx.com - Port:
587 - Username:
[email protected] - Password:
mrafie12345678910 - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 4 IoCs
resource yara_rule behavioral1/memory/2252-3-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2252-6-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2252-12-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2252-9-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org 8 reallyfreegeoip.org 9 reallyfreegeoip.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2916 set thread context of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2252 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2252 RegSvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2916 wrote to memory of 2252 2916 611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe 28 PID 2252 wrote to memory of 3052 2252 RegSvcs.exe 31 PID 2252 wrote to memory of 3052 2252 RegSvcs.exe 31 PID 2252 wrote to memory of 3052 2252 RegSvcs.exe 31 PID 2252 wrote to memory of 3052 2252 RegSvcs.exe 31 PID 3052 wrote to memory of 2628 3052 cmd.exe 33 PID 3052 wrote to memory of 2628 3052 cmd.exe 33 PID 3052 wrote to memory of 2628 3052 cmd.exe 33 PID 3052 wrote to memory of 2628 3052 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe"C:\Users\Admin\AppData\Local\Temp\611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\611a15d01208ad0010452147c4e153b89299e83450329fd2918ae88838fa6df5.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:2628
-
-
-