Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 19:34

General

  • Target

    a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.exe

  • Size

    1.4MB

  • MD5

    96a4885c4e2c4d005748b531c26b61d0

  • SHA1

    f2d5b366c11adc7632f94cd2cc7525f9b93bfea3

  • SHA256

    a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73

  • SHA512

    be1b5c53741b04b3d191fb32e4ddff468ac7cb735048b8bb9413fc8726b4e18c05b77395636170d47bf838c522541cea47cdefcb0a3071d67e57aa3a8248b763

  • SSDEEP

    24576:3Mjhfa5aaH+5vgpD650+RFo6kF/5SrkGB8PGqooMWiI05bmktUNudtJjdPrF:K/nog50+Ri6kokGB9qoC1ab7SNudXjdZ

Malware Config

Signatures

  • Detect Poverty Stealer Payload 4 IoCs
  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

  • Povertystealer family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to execute payload.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.exe
    "C:\Users\Admin\AppData\Local\Temp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Users\Admin\AppData\Local\Temp\is-3M088.tmp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3M088.tmp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.tmp" /SL5="$40150,1081243,161792,C:\Users\Admin\AppData\Local\Temp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Local\Temp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.exe
        "C:\Users\Admin\AppData\Local\Temp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.exe" /VERYSILENT
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Users\Admin\AppData\Local\Temp\is-0NPRV.tmp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-0NPRV.tmp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.tmp" /SL5="$50150,1081243,161792,C:\Users\Admin\AppData\Local\Temp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2344
          • C:\Windows\SysWOW64\regsvr32.exe
            "regsvr32.exe" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\9ntdll_4.drv"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2736
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\9ntdll_4.drv' }) { exit 0 } else { exit 1 }"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2836
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\Admin\AppData\Roaming\9ntdll_4.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{94B1F5C8-D240-4DE1-A292-2D3C771F5AFA}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\9ntdll_4.drv

    Filesize

    3.0MB

    MD5

    0cfacfa4f5044659a2928ec133ca6fb1

    SHA1

    d4ef7b298d5fc6e58a83cd994d9b739c82ff3188

    SHA256

    54d6ad606a151e075b2e854da88c876ace57c42d4c94ddf13acb2ccd8695bdce

    SHA512

    630bee59a1b1a8c461841e380364635f7c620a21102c1a347375602b827b3edaea3a7a23e6517b5a5124a02094c4a37f443b10728a92efae6e3817689078b63c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    e6f1ccd78ab0bedce0ca5bd477edaf7b

    SHA1

    22b5a40da04caa626714c6676f856ae6a96c63e4

    SHA256

    f85ed306a697c3e813ef6bc3eccfcb44525ac30a09405e933a458333edee92f8

    SHA512

    efa92c7e7d8302425591a5c812e096197b797257ccf9903f092b2b1cde3ae71237300a57f62ccfac8530645ca3538dd8b15edd7f157099dcde9452e18255a030

  • \Users\Admin\AppData\Local\Temp\is-3M088.tmp\a2d53e86197c92c8532daac73fde6cfbe913940fc2fbfd7f76f862879d83de73N.tmp

    Filesize

    1.1MB

    MD5

    bcc236a3921e1388596a42b05686ff5e

    SHA1

    43bffbbac6a1bf5f1fa21e971e06e6f1d0af9263

    SHA256

    43a656bcd060e8a36502ca2deb878d56a99078f13d3e57dcd73a87128588c9e9

    SHA512

    e3baaf1a8f4eb0e1ab57a1fb35bc7ded476606b65fafb09835d34705d8c661819c3cfa0ecc43c5a0d0085fd570df581438de27944e054e12c09a6933bbf5ce04

  • \Users\Admin\AppData\Local\Temp\is-S1CN0.tmp\_isetup\_isdecmp.dll

    Filesize

    13KB

    MD5

    a813d18268affd4763dde940246dc7e5

    SHA1

    c7366e1fd925c17cc6068001bd38eaef5b42852f

    SHA256

    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

    SHA512

    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

  • \Users\Admin\AppData\Local\Temp\is-S1CN0.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/2196-53-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2196-21-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2196-27-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2344-51-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/2736-72-0x0000000000240000-0x000000000024A000-memory.dmp

    Filesize

    40KB

  • memory/2736-65-0x0000000000240000-0x000000000024A000-memory.dmp

    Filesize

    40KB

  • memory/2736-69-0x0000000000240000-0x000000000024A000-memory.dmp

    Filesize

    40KB

  • memory/2736-71-0x0000000000240000-0x000000000024A000-memory.dmp

    Filesize

    40KB

  • memory/2736-73-0x00000000748D0000-0x0000000074B96000-memory.dmp

    Filesize

    2.8MB

  • memory/2904-26-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2904-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2904-2-0x0000000000401000-0x0000000000417000-memory.dmp

    Filesize

    88KB

  • memory/3044-24-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/3044-8-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB