Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2025, 21:32

250312-1dmynatxey 10

11/03/2025, 16:10

250311-tmgdxaxnx4 10

06/03/2025, 02:30

250306-cze8yav1az 10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2025, 02:30

General

  • Target

    5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe

  • Size

    659KB

  • MD5

    183ebe37f8f5b5b3e324577327363c3f

  • SHA1

    8ae40a52e750efa0f8c7014583770f9ff2343291

  • SHA256

    5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb

  • SHA512

    0b2600468a1977e14f592ca5ddda8ec5c0ab8bcab15a3cce9107360e3fdc95b00f55f424ba42ab9ba6624586e5e9f27d00270adf12e5f651ef5c46030b186034

  • SSDEEP

    12288:X6jPyvD3aKx7bqyLZY7NsNAVSW/4zwHJeJ7zzwHJe:6sK4/qyLZoQAVSW/uwpeJDwpe

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 6 IoCs
  • Snakekeylogger family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
    "C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe
      "C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Users\Admin\AppData\Local\Temp\FB_1A59.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\FB_1A59.tmp.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        PID:4584
      • C:\Users\Admin\AppData\Local\Temp\FB_1B25.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\FB_1B25.tmp.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 1808
          4⤵
          • Program crash
          PID:4052
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3600
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb.exe" "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3864
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4532 -ip 4532
    1⤵
      PID:4320
    • C:\Users\Admin\AppData\Roaming\sergf\sergf.exe
      C:\Users\Admin\AppData\Roaming\sergf\sergf.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Users\Admin\AppData\Roaming\sergf\sergf.exe
        "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"
        2⤵
        • Executes dropped EXE
        PID:4876
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\sergf\sergf.exe'" /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1644
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe" "C:\Users\Admin\AppData\Roaming\sergf\sergf.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\FB_1A59.tmp.exe

      Filesize

      69KB

      MD5

      0052d6c22b3c528c011b2e093155f8e0

      SHA1

      e176827903acb3f96b4114b036a0cda8646331d9

      SHA256

      eef635d1c6f58320072d6b4b762bee15d559978f2d150726a0fef3f83627871f

      SHA512

      b6f1f20b43b2af9633d16532be2d05a1ece10d99a83481913b254a5301e0c7934a8035fc0ba752a5c863aea1828665ad99e69c8ccdaa086544f228beb72db50a

    • C:\Users\Admin\AppData\Local\Temp\FB_1B25.tmp.exe

      Filesize

      126KB

      MD5

      6871e4e3ce2b458881aa007560ef80b5

      SHA1

      e2a3fb4dc3d184693aed6b3c2f2f3065fdb0ff4e

      SHA256

      39e83410a9e1b504499680e98c3a4c5b7f272bf74e72528c8796f97ef6868c6e

      SHA512

      8bf95a29c79123bfd88f3ebbf1abd5095ce0bafac9cf9f97b619f4a1ab3e6df2574b9d24e9157b9da0d64240fa63818467ae31a0f2e139e411330a718371c7ef

    • C:\Users\Admin\AppData\Roaming\sergf\sergf.exe

      Filesize

      659KB

      MD5

      183ebe37f8f5b5b3e324577327363c3f

      SHA1

      8ae40a52e750efa0f8c7014583770f9ff2343291

      SHA256

      5f278f8bdee6e51c769320f10506c28a4e84a56ee3ff44f63eec9a189236b1cb

      SHA512

      0b2600468a1977e14f592ca5ddda8ec5c0ab8bcab15a3cce9107360e3fdc95b00f55f424ba42ab9ba6624586e5e9f27d00270adf12e5f651ef5c46030b186034

    • memory/2604-11-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2604-13-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2604-9-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2728-50-0x00000000004A0000-0x000000000054A000-memory.dmp

      Filesize

      680KB

    • memory/2980-6-0x00000000052C0000-0x00000000052CA000-memory.dmp

      Filesize

      40KB

    • memory/2980-8-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2980-7-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

      Filesize

      4KB

    • memory/2980-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

      Filesize

      4KB

    • memory/2980-5-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB

    • memory/2980-4-0x00000000054B0000-0x0000000005516000-memory.dmp

      Filesize

      408KB

    • memory/2980-3-0x0000000005410000-0x00000000054A2000-memory.dmp

      Filesize

      584KB

    • memory/2980-1-0x0000000000670000-0x000000000071A000-memory.dmp

      Filesize

      680KB

    • memory/2980-2-0x00000000059C0000-0x0000000005F64000-memory.dmp

      Filesize

      5.6MB

    • memory/4532-37-0x0000000004D80000-0x0000000004E1C000-memory.dmp

      Filesize

      624KB

    • memory/4532-35-0x0000000000440000-0x0000000000466000-memory.dmp

      Filesize

      152KB

    • memory/4584-40-0x000000001C220000-0x000000001C6EE000-memory.dmp

      Filesize

      4.8MB

    • memory/4584-41-0x000000001C790000-0x000000001C82C000-memory.dmp

      Filesize

      624KB

    • memory/4584-42-0x000000001C9E0000-0x000000001CA86000-memory.dmp

      Filesize

      664KB

    • memory/4584-43-0x0000000001670000-0x0000000001678000-memory.dmp

      Filesize

      32KB

    • memory/4584-47-0x0000000001690000-0x00000000016A0000-memory.dmp

      Filesize

      64KB

    • memory/4584-36-0x0000000001690000-0x00000000016A0000-memory.dmp

      Filesize

      64KB