Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 13:22
Behavioral task
behavioral1
Sample
17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe
Resource
win10v2004-20241007-en
General
-
Target
17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe
-
Size
170KB
-
MD5
236d3fc78c734bbc2f6e99e366083dc0
-
SHA1
ac105cc15e018a99d82121a11852484b72d9e450
-
SHA256
17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411e
-
SHA512
1db08c95c35e1279892c2c9a24b6387cb0e7775885156fa6bc6ce32655620566bf4c4470cc8538f896badd18df0ccf2f6d14f9d91430728298a9b4085351cc19
-
SSDEEP
3072:S+STW8djpN6izj8mZwOI03cMErxe2SlkIPu/i9bSJ2c1ac6+WpP:P8XN6W8mmOI03c7ylJPSi9b6X
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6679282300:AAGbOMigj8BL4XN9ZHdgg5mtGSlrkMuWBnE/sendMessage?chat_id=6348227332
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral1/memory/2264-1-0x0000000000160000-0x0000000000190000-memory.dmp family_stormkitty -
Stormkitty family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 7 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\a9b51b3218a1ff7ea23e71c7f9682a01\Admin@XECUDNCD_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe File created C:\Users\Admin\AppData\Local\a9b51b3218a1ff7ea23e71c7f9682a01\Admin@XECUDNCD_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe File opened for modification C:\Users\Admin\AppData\Local\a9b51b3218a1ff7ea23e71c7f9682a01\Admin@XECUDNCD_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe File opened for modification C:\Users\Admin\AppData\Local\a9b51b3218a1ff7ea23e71c7f9682a01\Admin@XECUDNCD_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe File created C:\Users\Admin\AppData\Local\a9b51b3218a1ff7ea23e71c7f9682a01\Admin@XECUDNCD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe File opened for modification C:\Users\Admin\AppData\Local\a9b51b3218a1ff7ea23e71c7f9682a01\Admin@XECUDNCD_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe File created C:\Users\Admin\AppData\Local\a9b51b3218a1ff7ea23e71c7f9682a01\Admin@XECUDNCD_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1484 cmd.exe 1756 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2264 wrote to memory of 1484 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 32 PID 2264 wrote to memory of 1484 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 32 PID 2264 wrote to memory of 1484 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 32 PID 2264 wrote to memory of 1484 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 32 PID 1484 wrote to memory of 1396 1484 cmd.exe 34 PID 1484 wrote to memory of 1396 1484 cmd.exe 34 PID 1484 wrote to memory of 1396 1484 cmd.exe 34 PID 1484 wrote to memory of 1396 1484 cmd.exe 34 PID 1484 wrote to memory of 1756 1484 cmd.exe 35 PID 1484 wrote to memory of 1756 1484 cmd.exe 35 PID 1484 wrote to memory of 1756 1484 cmd.exe 35 PID 1484 wrote to memory of 1756 1484 cmd.exe 35 PID 1484 wrote to memory of 1228 1484 cmd.exe 36 PID 1484 wrote to memory of 1228 1484 cmd.exe 36 PID 1484 wrote to memory of 1228 1484 cmd.exe 36 PID 1484 wrote to memory of 1228 1484 cmd.exe 36 PID 2264 wrote to memory of 2128 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 37 PID 2264 wrote to memory of 2128 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 37 PID 2264 wrote to memory of 2128 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 37 PID 2264 wrote to memory of 2128 2264 17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe 37 PID 2128 wrote to memory of 1488 2128 cmd.exe 39 PID 2128 wrote to memory of 1488 2128 cmd.exe 39 PID 2128 wrote to memory of 1488 2128 cmd.exe 39 PID 2128 wrote to memory of 1488 2128 cmd.exe 39 PID 2128 wrote to memory of 1924 2128 cmd.exe 40 PID 2128 wrote to memory of 1924 2128 cmd.exe 40 PID 2128 wrote to memory of 1924 2128 cmd.exe 40 PID 2128 wrote to memory of 1924 2128 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe"C:\Users\Admin\AppData\Local\Temp\17547e81212d54897a4060e58d4575b270565da3220bb59b5ca90673253c411eN.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:1396
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1756
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
PID:1228
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:1488
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1924
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5cfcd208495d565ef66e7dff9f98764da
SHA1b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA2565feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA51231bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99