Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 03:05
Behavioral task
behavioral1
Sample
7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe
Resource
win10v2004-20241007-en
General
-
Target
7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe
-
Size
178KB
-
MD5
718db92b63e8d468d2486f8222427c77
-
SHA1
e0d354a3159477957ff06435ecfa38bce32f1f2e
-
SHA256
7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d
-
SHA512
4f936667e6dbb0d08709ebab96829c874a9c1285d9665e23379b15047335cc3109b0aaf53e32d9df39a52ed6beecc6dc4d615c84e2add4701abd160feb1990f1
-
SSDEEP
3072:r/H9jF3sXqPXlXmbGQz1i8dOyucD1sM+lmsolAIrRuw+mqv9j1MWLQI:jHHsOmbrhwK+lDAA
Malware Config
Extracted
xworm
198.7.115.133:7772
-
Install_directory
%AppData%
-
install_file
MSClient.exe
Signatures
-
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/memory/2316-1-0x0000000000130000-0x0000000000162000-memory.dmp family_xworm behavioral1/files/0x0004000000004ed7-35.dat family_xworm behavioral1/memory/1884-37-0x0000000001040000-0x0000000001072000-memory.dmp family_xworm -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral1/memory/2316-9-0x000000001CAD0000-0x000000001CBF0000-memory.dmp family_stormkitty -
Stormkitty family
-
Xworm family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSClient.lnk 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSClient.lnk 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe -
Executes dropped EXE 2 IoCs
pid Process 1884 MSClient.exe 2008 MSClient.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSClient = "C:\\Users\\Admin\\AppData\\Roaming\\MSClient.exe" 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2728 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe Token: SeDebugPrivilege 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe Token: SeDebugPrivilege 1884 MSClient.exe Token: SeDebugPrivilege 2008 MSClient.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2728 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe 31 PID 2316 wrote to memory of 2728 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe 31 PID 2316 wrote to memory of 2728 2316 7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe 31 PID 1764 wrote to memory of 1884 1764 taskeng.exe 35 PID 1764 wrote to memory of 1884 1764 taskeng.exe 35 PID 1764 wrote to memory of 1884 1764 taskeng.exe 35 PID 1764 wrote to memory of 2008 1764 taskeng.exe 37 PID 1764 wrote to memory of 2008 1764 taskeng.exe 37 PID 1764 wrote to memory of 2008 1764 taskeng.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe"C:\Users\Admin\AppData\Local\Temp\7d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "MSClient" /tr "C:\Users\Admin\AppData\Roaming\MSClient.exe"2⤵
- Scheduled Task/Job: Scheduled Task
PID:2728
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {CC56CBEB-F2C6-4311-B8A5-0E566413718D} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Roaming\MSClient.exeC:\Users\Admin\AppData\Roaming\MSClient.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Users\Admin\AppData\Roaming\MSClient.exeC:\Users\Admin\AppData\Roaming\MSClient.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178KB
MD5718db92b63e8d468d2486f8222427c77
SHA1e0d354a3159477957ff06435ecfa38bce32f1f2e
SHA2567d47a0ba9eeeb8fb9d25bc2c6acdc99408460d6d6b15957b487b3df724e9184d
SHA5124f936667e6dbb0d08709ebab96829c874a9c1285d9665e23379b15047335cc3109b0aaf53e32d9df39a52ed6beecc6dc4d615c84e2add4701abd160feb1990f1