Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/01/2025, 03:29
250113-d1z56swner 1013/01/2025, 00:35
250113-axdk8azkfp 1013/01/2025, 00:02
250113-abma8sykhp 1012/01/2025, 13:03
250112-qaqv2awjhj 10Analysis
-
max time kernel
147s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe
Resource
win10v2004-20241007-en
General
-
Target
e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe
-
Size
760KB
-
MD5
d2b8506820fe3c39b6b5e891170f3451
-
SHA1
30f6fa21f06d99b0254fa1ff387c45921317eda7
-
SHA256
e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480
-
SHA512
15b10c694ff797b8ffbcde18752c2df2d16f961d367794df7f8932bb5bc861faef9984b6b780910eb28c5e1caaa302a0d39d9ca44fb988e84a232d24b7f28781
-
SSDEEP
12288:YjlIpHtMPku+l0CPPoJts5Pic17D44ehsA4iFMZUiqrbA8yJNB:YjlIhSPd+pWtAPic17Dehx442B
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6331768257:AAE1Rrc3F4A-nTJkfXEukNBriTate8i72L8/sendMessage?chat_id=5287158069
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 5 IoCs
resource yara_rule behavioral1/memory/2800-17-0x0000000000400000-0x0000000000432000-memory.dmp family_stormkitty behavioral1/memory/2800-15-0x0000000000400000-0x0000000000432000-memory.dmp family_stormkitty behavioral1/memory/2800-13-0x0000000000400000-0x0000000000432000-memory.dmp family_stormkitty behavioral1/memory/2800-10-0x0000000000400000-0x0000000000432000-memory.dmp family_stormkitty behavioral1/memory/2800-9-0x0000000000400000-0x0000000000432000-memory.dmp family_stormkitty -
Stormkitty family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe File created C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe File opened for modification C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe File created C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe File opened for modification C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe File created C:\Users\Admin\AppData\Local\e01fa2b916e0e1663bda90e6b57169e8\Admin@CCJBVTGQ_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2288 set thread context of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2900 cmd.exe 1916 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe Token: SeDebugPrivilege 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2756 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 31 PID 2288 wrote to memory of 2756 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 31 PID 2288 wrote to memory of 2756 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 31 PID 2288 wrote to memory of 2756 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 31 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2288 wrote to memory of 2800 2288 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 32 PID 2800 wrote to memory of 2900 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 34 PID 2800 wrote to memory of 2900 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 34 PID 2800 wrote to memory of 2900 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 34 PID 2800 wrote to memory of 2900 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 34 PID 2900 wrote to memory of 2916 2900 cmd.exe 36 PID 2900 wrote to memory of 2916 2900 cmd.exe 36 PID 2900 wrote to memory of 2916 2900 cmd.exe 36 PID 2900 wrote to memory of 2916 2900 cmd.exe 36 PID 2900 wrote to memory of 1916 2900 cmd.exe 37 PID 2900 wrote to memory of 1916 2900 cmd.exe 37 PID 2900 wrote to memory of 1916 2900 cmd.exe 37 PID 2900 wrote to memory of 1916 2900 cmd.exe 37 PID 2900 wrote to memory of 492 2900 cmd.exe 38 PID 2900 wrote to memory of 492 2900 cmd.exe 38 PID 2900 wrote to memory of 492 2900 cmd.exe 38 PID 2900 wrote to memory of 492 2900 cmd.exe 38 PID 2800 wrote to memory of 2444 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 39 PID 2800 wrote to memory of 2444 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 39 PID 2800 wrote to memory of 2444 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 39 PID 2800 wrote to memory of 2444 2800 e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe 39 PID 2444 wrote to memory of 1968 2444 cmd.exe 41 PID 2444 wrote to memory of 1968 2444 cmd.exe 41 PID 2444 wrote to memory of 1968 2444 cmd.exe 41 PID 2444 wrote to memory of 1968 2444 cmd.exe 41 PID 2444 wrote to memory of 1708 2444 cmd.exe 42 PID 2444 wrote to memory of 1708 2444 cmd.exe 42 PID 2444 wrote to memory of 1708 2444 cmd.exe 42 PID 2444 wrote to memory of 1708 2444 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe"C:\Users\Admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe"C:\Users\Admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe"2⤵PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe"C:\Users\Admin\AppData\Local\Temp\e1e6a513abf55583458cd88ec8b7af9ce2a60d169526b0e6a31183a7688b8480.exe"2⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1916
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
- System Location Discovery: System Language Discovery
PID:492
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
- System Location Discovery: System Language Discovery
PID:1968
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1708
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99