Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 05:24

General

  • Target

    c88a778bbc27987aaa0f0ed646afccd7601102adad31cb45daf382f6c165d371.exe

  • Size

    1.7MB

  • MD5

    b86acd446f0cdc8f7c2ef87545f5ea0d

  • SHA1

    f4d2ffba82a0e72e18ad80a0b2c858bcb2aa2197

  • SHA256

    c88a778bbc27987aaa0f0ed646afccd7601102adad31cb45daf382f6c165d371

  • SHA512

    6d00ce1814b1a0a9ce3e4f2be42e86be94bfb3fdfe0a1e62e02dd0db6275990f90461ed37b93e86bc2b6ef26774058e5353199848b7e16fd001aae04cc8dc717

  • SSDEEP

    49152:v+7yfYe+CZCng9GI+0f+MYyrrp1R2174LY:v+UYeEg9G4f+fy7l8

Malware Config

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c88a778bbc27987aaa0f0ed646afccd7601102adad31cb45daf382f6c165d371.exe
    "C:\Users\Admin\AppData\Local\Temp\c88a778bbc27987aaa0f0ed646afccd7601102adad31cb45daf382f6c165d371.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2816-0-0x0000000001040000-0x00000000016D1000-memory.dmp

    Filesize

    6.6MB

  • memory/2816-1-0x0000000076F50000-0x0000000076F52000-memory.dmp

    Filesize

    8KB

  • memory/2816-2-0x0000000001041000-0x0000000001058000-memory.dmp

    Filesize

    92KB

  • memory/2816-5-0x0000000001040000-0x00000000016D1000-memory.dmp

    Filesize

    6.6MB

  • memory/2816-4-0x0000000001040000-0x00000000016D1000-memory.dmp

    Filesize

    6.6MB

  • memory/2816-6-0x0000000001040000-0x00000000016D1000-memory.dmp

    Filesize

    6.6MB