Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
14/07/2020, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
KPmhGSHXD1wimFC.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
KPmhGSHXD1wimFC.exe
Resource
win10
General
-
Target
KPmhGSHXD1wimFC.exe
-
Size
992KB
-
MD5
85ab3d51b6eff203312f462c3fbf9949
-
SHA1
1d0bc22e301e8f90f34ef3487da286dd34895035
-
SHA256
dace2f4b76d741282866cb3e5038e7b2008817ed8f7079d5d764099be01d34bb
-
SHA512
758043f044983be55a9885eae098bf7af99ba714e932734f8444d77684c6874e328af2d5abd0b72e6c8d9e6f5dfe70e943e47632a3b0794a4754d54761cc63b3
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1780 KPmhGSHXD1wimFC.exe 1780 KPmhGSHXD1wimFC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1780 KPmhGSHXD1wimFC.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1780 KPmhGSHXD1wimFC.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 892 set thread context of 1780 892 KPmhGSHXD1wimFC.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1780 KPmhGSHXD1wimFC.exe -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1740 schtasks.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 892 wrote to memory of 1740 892 KPmhGSHXD1wimFC.exe 26 PID 892 wrote to memory of 1740 892 KPmhGSHXD1wimFC.exe 26 PID 892 wrote to memory of 1740 892 KPmhGSHXD1wimFC.exe 26 PID 892 wrote to memory of 1740 892 KPmhGSHXD1wimFC.exe 26 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 PID 892 wrote to memory of 1780 892 KPmhGSHXD1wimFC.exe 28 -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
yara_rule masslogger_log_file
Processes
-
C:\Users\Admin\AppData\Local\Temp\KPmhGSHXD1wimFC.exe"C:\Users\Admin\AppData\Local\Temp\KPmhGSHXD1wimFC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VdIbjqKkGb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA69A.tmp"2⤵
- Creates scheduled task(s)
PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\KPmhGSHXD1wimFC.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:1780
-