Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
30/01/2025, 14:04
Behavioral task
behavioral1
Sample
UIServices.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
UIServices.exe
Resource
win10v2004-20250129-en
General
-
Target
UIServices.exe
-
Size
170KB
-
MD5
4376ea4b5ba0f8a061dc18342267e85c
-
SHA1
8d99fa9673835644c641ae4533f005dca4522f6c
-
SHA256
6508dd74c69d399050b07256b4b25cd66cfd774848d55fe330a9d77ad09ce03f
-
SHA512
24811d6dd05df0000b5d0948a833c49ef32a7e5fc3a5cab6c61e9331b6966026f03254eb1a8a9945e8a4e43d1e38bdebed2ec0e8337873de3386c4c4b5bde0a6
-
SSDEEP
3072:++STW8djpN6izj8mZwdJqutB+YDpqIPu/i9bVK2cw6+Wp7:j8XN6W8mmHPtppXPSi9b4
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6987227198:AAGW8xEs5eNdfO7EF-8152h-RqJkKbn52BE/sendMessage?chat_id=1075483951
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/1684-1-0x00000000006C0000-0x00000000006F0000-memory.dmp family_stormkitty -
Stormkitty family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini UIServices.exe File created C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini UIServices.exe File created C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini UIServices.exe File created C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini UIServices.exe File created C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini UIServices.exe File opened for modification C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini UIServices.exe File opened for modification C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini UIServices.exe File created C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini UIServices.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 icanhazip.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UIServices.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1116 cmd.exe 2920 netsh.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 UIServices.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier UIServices.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe 1684 UIServices.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1684 UIServices.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1116 1684 UIServices.exe 87 PID 1684 wrote to memory of 1116 1684 UIServices.exe 87 PID 1684 wrote to memory of 1116 1684 UIServices.exe 87 PID 1116 wrote to memory of 2312 1116 cmd.exe 89 PID 1116 wrote to memory of 2312 1116 cmd.exe 89 PID 1116 wrote to memory of 2312 1116 cmd.exe 89 PID 1116 wrote to memory of 2920 1116 cmd.exe 90 PID 1116 wrote to memory of 2920 1116 cmd.exe 90 PID 1116 wrote to memory of 2920 1116 cmd.exe 90 PID 1116 wrote to memory of 2984 1116 cmd.exe 91 PID 1116 wrote to memory of 2984 1116 cmd.exe 91 PID 1116 wrote to memory of 2984 1116 cmd.exe 91 PID 1684 wrote to memory of 4932 1684 UIServices.exe 92 PID 1684 wrote to memory of 4932 1684 UIServices.exe 92 PID 1684 wrote to memory of 4932 1684 UIServices.exe 92 PID 4932 wrote to memory of 3668 4932 cmd.exe 94 PID 4932 wrote to memory of 3668 4932 cmd.exe 94 PID 4932 wrote to memory of 3668 4932 cmd.exe 94 PID 4932 wrote to memory of 632 4932 cmd.exe 95 PID 4932 wrote to memory of 632 4932 cmd.exe 95 PID 4932 wrote to memory of 632 4932 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\UIServices.exe"C:\Users\Admin\AppData\Local\Temp\UIServices.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:2312
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2920
-
-
C:\Windows\SysWOW64\findstr.exefindstr All3⤵
- System Location Discovery: System Language Discovery
PID:2984
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
PID:3668
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:632
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\Browsers\Firefox\Bookmarks.txt
Filesize105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
C:\Users\Admin\AppData\Local\2a2c611cae6ed400b8dc2a1a23b56e50\Admin@HTOJJQCK_en-US\System\Process.txt
Filesize4KB
MD52eea63ec69edc66d9c94a5741d3d09e2
SHA183d5cea82c98e602de2056c9b7b977d710d7a71e
SHA2562863e4ac3e52d3c76cadfa34056e1c7b9839524954d3726cff4204ffb0b5c5ab
SHA512c904cd3a4da914d1d4936d40ffb3328b87c3c76afc860ab498bbb583c9ea989399e16987d4ca7e31e6e9607b0d8bafbbbc4aeb09d4605604bcb856908743a356
-
Filesize
4B
MD55763abe87ed1938799203fb6e8650025
SHA1db0f7c344abc887e46d4574db4d24d55df94f1fe
SHA256060c9d7a12050d242ea666cbceb82dcb3915628a914816806b76075d0b35e84d
SHA5121c4cc5fd76734c85473b97dc12758a319268e566ce4243fadbda4a68c788db275fda2422daa0a9eefc3c2e7fdb3418a49b215301ae73e789615d37621ebc9851