Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2025, 21:32

250312-1dmynatxey 10

11/03/2025, 16:10

250311-tmgdxaxnx4 10

06/03/2025, 02:30

250306-cze8yav1az 10

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2025, 02:30

General

  • Target

    5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe

  • Size

    659KB

  • MD5

    183ebe37f8f5b5b3e324577327363c3f

  • SHA1

    8ae40a52e750efa0f8c7014583770f9ff2343291

  • SHA256

    5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb

  • SHA512

    0b2600468a1977e14f592ca5ddda8ec5c0ab8bcab15a3cce9107360e3fdc95b00f55f424ba42ab9ba6624586e5e9f27d00270adf12e5f651ef5c46030b186034

  • SSDEEP

    12288:X6jPyvD3aKx7bqyLZY7NsNAVSW/4zwHJeJ7zzwHJe:6sK4/qyLZoQAVSW/uwpeJDwpe

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 6 IoCs
  • Snakekeylogger family
  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
    "C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
      "C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Users\Admin\AppData\Local\Temp\FB_DEAC.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\FB_DEAC.tmp.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        PID:1864
      • C:\Users\Admin\AppData\Local\Temp\FB_DECC.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\FB_DECC.tmp.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1580
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:688
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:592
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2012
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe" "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1488
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {F9A96A4D-F3E5-49F4-8D03-E947E6C3002E} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Users\Admin\AppData\Roaming\sergf\sergf.exe
      C:\Users\Admin\AppData\Roaming\sergf\sergf.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Users\Admin\AppData\Roaming\sergf\sergf.exe
        "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\Users\Admin\AppData\Local\Temp\FB_B7DA.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\FB_B7DA.tmp.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: SetClipboardViewer
          PID:1784
        • C:\Users\Admin\AppData\Local\Temp\FB_B839.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\FB_B839.tmp.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 1584
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2504
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1832
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe" "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.lnk

    Filesize

    1KB

    MD5

    579984b39286dab555a977d62ecb1136

    SHA1

    61ed99c5548c9e4da6cb58d2b6f4092b465f736c

    SHA256

    4d56991ab642d4473bbc416feb46029301f9d9598de3660743fdc9a202c407d0

    SHA512

    57ec65b74fb2b743525ff6d78d8e2e75b8fc27abe80cf945fd69f24a374bfdc21435853707c66abf3b0711136d230dc11e3ba74d6ca788f8f9bfe9be55a967e4

  • C:\Users\Admin\AppData\Roaming\sergf\sergf.exe

    Filesize

    659KB

    MD5

    183ebe37f8f5b5b3e324577327363c3f

    SHA1

    8ae40a52e750efa0f8c7014583770f9ff2343291

    SHA256

    5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb

    SHA512

    0b2600468a1977e14f592ca5ddda8ec5c0ab8bcab15a3cce9107360e3fdc95b00f55f424ba42ab9ba6624586e5e9f27d00270adf12e5f651ef5c46030b186034

  • \Users\Admin\AppData\Local\Temp\FB_DEAC.tmp.exe

    Filesize

    69KB

    MD5

    0052d6c22b3c528c011b2e093155f8e0

    SHA1

    e176827903acb3f96b4114b036a0cda8646331d9

    SHA256

    eef635d1c6f58320072d6b4b762bee15d559978f2d150726a0fef3f83627871f

    SHA512

    b6f1f20b43b2af9633d16532be2d05a1ece10d99a83481913b254a5301e0c7934a8035fc0ba752a5c863aea1828665ad99e69c8ccdaa086544f228beb72db50a

  • \Users\Admin\AppData\Local\Temp\FB_DECC.tmp.exe

    Filesize

    126KB

    MD5

    6871e4e3ce2b458881aa007560ef80b5

    SHA1

    e2a3fb4dc3d184693aed6b3c2f2f3065fdb0ff4e

    SHA256

    39e83410a9e1b504499680e98c3a4c5b7f272bf74e72528c8796f97ef6868c6e

    SHA512

    8bf95a29c79123bfd88f3ebbf1abd5095ce0bafac9cf9f97b619f4a1ab3e6df2574b9d24e9157b9da0d64240fa63818467ae31a0f2e139e411330a718371c7ef

  • memory/1296-75-0x0000000000360000-0x0000000000386000-memory.dmp

    Filesize

    152KB

  • memory/1536-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2300-3-0x00000000740CE000-0x00000000740CF000-memory.dmp

    Filesize

    4KB

  • memory/2300-0-0x00000000740CE000-0x00000000740CF000-memory.dmp

    Filesize

    4KB

  • memory/2300-4-0x00000000740C0000-0x00000000747AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2300-2-0x00000000740C0000-0x00000000747AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2300-1-0x0000000000900000-0x00000000009AA000-memory.dmp

    Filesize

    680KB

  • memory/2560-36-0x00000000010B0000-0x00000000010D6000-memory.dmp

    Filesize

    152KB

  • memory/2576-47-0x0000000000A30000-0x0000000000ADA000-memory.dmp

    Filesize

    680KB

  • memory/2668-9-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2668-21-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2668-19-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2668-17-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2668-5-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2668-7-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2668-13-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/2668-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2668-11-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB