Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 04:02

General

  • Target

    0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe

  • Size

    783KB

  • MD5

    97c6b2f3cf99db3d64f43c6c5235c09f

  • SHA1

    7ca4007e55170faf7286944317a8f65bb371ee5b

  • SHA256

    0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b

  • SHA512

    7e359b820921152a5db9f3315879e9c930275b96cdf99aa3721348fb8feece8c2fbe66531997e483114daf0a8c1d22a4b306e4e4e5af219b000f151225d9ba06

  • SSDEEP

    12288:dIFtAefmqLUMssPOBeszIxhGNOuWHd9Xh4+iqo9wSf0me5nxtjRjc2Adoq:dULfm49eNAALW9rBix5eTtjW2E

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    kashmirestore.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    c%P+6,(]YFvP

Extracted

Family

vipkeylogger

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe
    "C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2352
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JphoYNZfTw.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1984
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JphoYNZfTw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp271.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2808
    • C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe
      "C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe"
      2⤵
        PID:2892
      • C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe
        "C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe"
        2⤵
          PID:2900
        • C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe
          "C:\Users\Admin\AppData\Local\Temp\0ecddd957a515d3d3ddc583b3f451d56f56273cfc844c13a8cb0b78d10b3c52b.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:2744

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp271.tmp

        Filesize

        1KB

        MD5

        8afc4859de78ce883a534c027dc90718

        SHA1

        28602127385e1e387487edfd153b50a822e594f4

        SHA256

        f791cb2b680ad5f276439266c4b04520b4a40c460bbfd38b4e45b052d9002d3f

        SHA512

        a16aaefdd679dbb2d09c90b46c8ed41db992c63ba06a9c23b6362ebe4410d3a1fb742b987979f89d67ad99fd8eb9cced0fd96622fc2e999ce903b14c96b24132

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

        Filesize

        7KB

        MD5

        025e6a92c7e249ef60c30e5889792054

        SHA1

        e8410b244270d0ac5f0a6a52baf18923d8dc78ac

        SHA256

        1e2a866e407727c3825453980e446a16aaac46345088d8c8a5c343f90fbfd148

        SHA512

        3db2ba7eeae6cbe0e5831d0d66218ac361864ef7172a6682c6c4ded9383511afb50ef8ebf74f390a3bfd7a2a23d557b6074011238433fc899d2bd5ee2853725d

      • memory/2744-29-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/2744-32-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/2744-21-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/2744-23-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/2744-25-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/2744-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2744-28-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/2744-19-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/3068-6-0x0000000000470000-0x00000000004FE000-memory.dmp

        Filesize

        568KB

      • memory/3068-31-0x0000000074C00000-0x00000000752EE000-memory.dmp

        Filesize

        6.9MB

      • memory/3068-0-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

        Filesize

        4KB

      • memory/3068-1-0x0000000001220000-0x00000000012EA000-memory.dmp

        Filesize

        808KB

      • memory/3068-2-0x0000000074C00000-0x00000000752EE000-memory.dmp

        Filesize

        6.9MB

      • memory/3068-3-0x00000000003E0000-0x00000000003FE000-memory.dmp

        Filesize

        120KB

      • memory/3068-5-0x0000000074C00000-0x00000000752EE000-memory.dmp

        Filesize

        6.9MB

      • memory/3068-4-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

        Filesize

        4KB