Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2025, 16:46

General

  • Target

    Atteched Request.exe

  • Size

    618KB

  • MD5

    d3b15e236df60a0e551bf21a26718250

  • SHA1

    66626b523351b325c5d58569ec29d6a197698345

  • SHA256

    dbc06aa2f5d8c73c079f19b7799691da6109b3a2afa2ea066c90afbab963acc2

  • SHA512

    c4727719c3ec92599e6b0db89c197d102bccc1600c67089ec01bdf3cf1b075b79154febb29b69ac5303495f0859353a527a8583aee5e4ede8e217529e2b4c6b1

  • SSDEEP

    6144:5o5JyDt117h5r2V96LUAqGMkMaAxfdXLJHOoOyX9nK6OyJvW/SNRaOlmDD9LGwYd:5RGGUAqGmJd9n1OyJOKtlm9pYr+0

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Leternel01@

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 5 IoCs
  • Snakekeylogger family
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe
    "C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe
      "C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe"
      2⤵
        PID:2760
      • C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe
        "C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe"
        2⤵
          PID:2904
        • C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe
          "C:\Users\Admin\AppData\Local\Temp\Atteched Request.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:2884

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2696-0-0x000000007469E000-0x000000007469F000-memory.dmp

        Filesize

        4KB

      • memory/2696-1-0x0000000000A90000-0x0000000000B30000-memory.dmp

        Filesize

        640KB

      • memory/2696-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2696-3-0x0000000000450000-0x000000000046E000-memory.dmp

        Filesize

        120KB

      • memory/2696-4-0x000000007469E000-0x000000007469F000-memory.dmp

        Filesize

        4KB

      • memory/2696-5-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2696-6-0x0000000000390000-0x00000000003FC000-memory.dmp

        Filesize

        432KB

      • memory/2696-23-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2884-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2884-17-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2884-19-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2884-13-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2884-11-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2884-9-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2884-7-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2884-22-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2884-21-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2884-24-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2884-25-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB

      • memory/2884-26-0x0000000074690000-0x0000000074D7E000-memory.dmp

        Filesize

        6.9MB