Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe
Resource
win10v2004-20241007-en
General
-
Target
0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe
-
Size
1004KB
-
MD5
286d68b773e946b301bd7134769a58e6
-
SHA1
82004957c97f892b7ae6025c333bc6da0b17ca1a
-
SHA256
0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894
-
SHA512
a4a4d4ba2abb064106bacbe92da3006be0176aec44282410fc56cdf32fea7611863b2b477de7799f7a8d5588305d66626cfcc13d46ae39e1c32d502e127313ae
-
SSDEEP
24576:du6J33O0c+JY5UZ+XC0kGso6FaONm/SWCEr41WY:vu0c++OCvkGs9FaONBWJrJY
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7838541807:AAEJadvLoc1DBjJfseqmrMSpZAXwRkaHwwk/sendMessage?chat_id=7488699642
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 3 IoCs
resource yara_rule behavioral1/memory/2556-22-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2556-24-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2556-26-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\outbluffed.vbs outbluffed.exe -
Executes dropped EXE 1 IoCs
pid Process 2908 outbluffed.exe -
Loads dropped DLL 1 IoCs
pid Process 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 reallyfreegeoip.org 9 reallyfreegeoip.org 4 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x002f000000018bd7-12.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2908 set thread context of 2556 2908 outbluffed.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outbluffed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2556 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2908 outbluffed.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2556 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 2908 outbluffed.exe 2908 outbluffed.exe 2908 outbluffed.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 2908 outbluffed.exe 2908 outbluffed.exe 2908 outbluffed.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2908 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 30 PID 2004 wrote to memory of 2908 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 30 PID 2004 wrote to memory of 2908 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 30 PID 2004 wrote to memory of 2908 2004 0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe 30 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2908 wrote to memory of 2556 2908 outbluffed.exe 31 PID 2556 wrote to memory of 3052 2556 RegSvcs.exe 32 PID 2556 wrote to memory of 3052 2556 RegSvcs.exe 32 PID 2556 wrote to memory of 3052 2556 RegSvcs.exe 32 PID 2556 wrote to memory of 3052 2556 RegSvcs.exe 32 PID 3052 wrote to memory of 628 3052 cmd.exe 34 PID 3052 wrote to memory of 628 3052 cmd.exe 34 PID 3052 wrote to memory of 628 3052 cmd.exe 34 PID 3052 wrote to memory of 628 3052 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe"C:\Users\Admin\AppData\Local\Temp\0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\maneuverability\outbluffed.exe"C:\Users\Admin\AppData\Local\Temp\0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\0eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
- System Location Discovery: System Language Discovery
PID:628
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1004KB
MD5286d68b773e946b301bd7134769a58e6
SHA182004957c97f892b7ae6025c333bc6da0b17ca1a
SHA2560eb8abfd2709e701ef3a5263c404a107e328537af080cd9e976fa199eb5d8894
SHA512a4a4d4ba2abb064106bacbe92da3006be0176aec44282410fc56cdf32fea7611863b2b477de7799f7a8d5588305d66626cfcc13d46ae39e1c32d502e127313ae