Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
e335078f6ee775e39fd9955c1c93bd14.exe
Resource
win7-20240729-en
General
-
Target
e335078f6ee775e39fd9955c1c93bd14.exe
-
Size
5.1MB
-
MD5
e335078f6ee775e39fd9955c1c93bd14
-
SHA1
fdaa16e36eeed2c608a356ba19e5c0804547755f
-
SHA256
7914fb76e64e6766ca024f023a2ea009ddce2c41d35582bdd68e1a4197cdda48
-
SHA512
5ddcbe5e5fa0be766fffeeab22bf2673d0e02fa2d06edf3bef5dc2d26bcd6e2bfebd76c1a8cce8bba49921c500b7c7d9c5802b2a4cc3f55c7677c9912c6cbf78
-
SSDEEP
49152:sfIUl6H/gY9Zo2WT5xl6lakEjs12Syq8tK5CB0Jl8uwxPKqG5zhT+qkj4atwgMJ:G7lc/f3WT5IIj1KkdO8k9t1nv
Malware Config
Extracted
stealc
Voov
http://154.216.20.246
-
url_path
/4bbfd212e4bc2b67.php
Signatures
-
Stealc family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4224 set thread context of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 -
Program crash 2 IoCs
pid pid_target Process procid_target 4868 912 WerFault.exe 99 3500 912 WerFault.exe 99 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e335078f6ee775e39fd9955c1c93bd14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BitLockerToGo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BitLockerToGo.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 912 BitLockerToGo.exe 912 BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99 PID 4224 wrote to memory of 912 4224 e335078f6ee775e39fd9955c1c93bd14.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\e335078f6ee775e39fd9955c1c93bd14.exe"C:\Users\Admin\AppData\Local\Temp\e335078f6ee775e39fd9955c1c93bd14.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 12403⤵
- Program crash
PID:4868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 12603⤵
- Program crash
PID:3500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 912 -ip 9121⤵PID:2676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 912 -ip 9121⤵PID:4732