Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 06:06

General

  • Target

    96be34e4d24ac78332b1fe4448f582df0c88b1b6087a9c36a8fe6a132c8a27be.exe

  • Size

    1.8MB

  • MD5

    334d7053c24fb659f9fb6eac63709e36

  • SHA1

    fdecff0c2d8cbbe5744c2aa96ca4bee094ee3017

  • SHA256

    96be34e4d24ac78332b1fe4448f582df0c88b1b6087a9c36a8fe6a132c8a27be

  • SHA512

    6b53cad41401ec0b8b880ffd1dceaf1d36224773111a9ad09bd71446982ad0edbdaf6704e076a1759185455f5cf72e4c169b61b2d61c15642b3ea0bb21634cdf

  • SSDEEP

    49152:6lJcRimYCgvvZgySGaADdjznZtlOoY/+sauV:KEimY/vhSSfwoYY0

Malware Config

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\96be34e4d24ac78332b1fe4448f582df0c88b1b6087a9c36a8fe6a132c8a27be.exe
    "C:\Users\Admin\AppData\Local\Temp\96be34e4d24ac78332b1fe4448f582df0c88b1b6087a9c36a8fe6a132c8a27be.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2152-0-0x00000000003B0000-0x0000000000A5F000-memory.dmp

    Filesize

    6.7MB

  • memory/2152-1-0x0000000077DD0000-0x0000000077DD2000-memory.dmp

    Filesize

    8KB

  • memory/2152-2-0x00000000003B1000-0x00000000003C8000-memory.dmp

    Filesize

    92KB

  • memory/2152-5-0x00000000003B0000-0x0000000000A5F000-memory.dmp

    Filesize

    6.7MB

  • memory/2152-4-0x00000000003B0000-0x0000000000A5F000-memory.dmp

    Filesize

    6.7MB

  • memory/2152-6-0x00000000003B0000-0x0000000000A5F000-memory.dmp

    Filesize

    6.7MB