Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 02:47
Static task
static1
Behavioral task
behavioral1
Sample
2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe
Resource
win10v2004-20241007-en
General
-
Target
2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe
-
Size
1.1MB
-
MD5
88ae8bda9d82167c30205b7be959d2b5
-
SHA1
204d1aa6f9cfb662babba813bbbe54371c11d6b3
-
SHA256
2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076
-
SHA512
cf88685cdaa09c6062e761b2d2b06f3636340b1c96d648a968b4655b32fd7716c5f08fa1d5a0d701ec6d001cc5a9eee75817d8a9fcb475ac404c18e6af071320
-
SSDEEP
24576:xqDEvCTbMWu7rQYlBQcBiT6rprG8aSVXndE2dx4B:xTvC/MTQYxsWR7aSFdE2v
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.wxtp.store - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@@ - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\savagenesses.vbs savagenesses.exe -
Executes dropped EXE 1 IoCs
pid Process 972 savagenesses.exe -
Loads dropped DLL 6 IoCs
pid Process 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org 8 reallyfreegeoip.org 9 reallyfreegeoip.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000700000001941b-8.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 972 set thread context of 2816 972 savagenesses.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2876 972 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language savagenesses.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2816 RegSvcs.exe 2816 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 972 savagenesses.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2816 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 972 savagenesses.exe 972 savagenesses.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 972 savagenesses.exe 972 savagenesses.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1920 wrote to memory of 972 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 31 PID 1920 wrote to memory of 972 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 31 PID 1920 wrote to memory of 972 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 31 PID 1920 wrote to memory of 972 1920 2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe 31 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2816 972 savagenesses.exe 32 PID 972 wrote to memory of 2876 972 savagenesses.exe 33 PID 972 wrote to memory of 2876 972 savagenesses.exe 33 PID 972 wrote to memory of 2876 972 savagenesses.exe 33 PID 972 wrote to memory of 2876 972 savagenesses.exe 33 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe"C:\Users\Admin\AppData\Local\Temp\2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\toggeries\savagenesses.exe"C:\Users\Admin\AppData\Local\Temp\2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\2e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 3163⤵
- Loads dropped DLL
- Program crash
PID:2876
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD5923dd36436ce48d1a7fc88014046ae5b
SHA1e7435cbb493aeee6b5aa341817fd7445427ef199
SHA25679f6a8adb018d08ba2f9ed4cbd36a4d8a3f39548ce64da608f0458cbfe1aa4f3
SHA5124085f245abfdd889793c700aeb27e60313908a6fdd4fc30b0a5f3777a051d1397a6d42b7c9b8587f6135da941b045e319aa19968ce24fdd5a61e981359e87e76
-
Filesize
1.1MB
MD588ae8bda9d82167c30205b7be959d2b5
SHA1204d1aa6f9cfb662babba813bbbe54371c11d6b3
SHA2562e6f9a5fcfce60e9a28545dd9171993ed51d5e6ddb90643b9d3ea16f64c8a076
SHA512cf88685cdaa09c6062e761b2d2b06f3636340b1c96d648a968b4655b32fd7716c5f08fa1d5a0d701ec6d001cc5a9eee75817d8a9fcb475ac404c18e6af071320