Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    25/10/2020, 08:00

General

  • Target

    8329f8176e926053fc9a4db2f9eb09aff6fec31c197e919ae26cb9501926c516.exe

  • Size

    1.5MB

  • MD5

    6283d7dedf246ce837a43b9843356cd4

  • SHA1

    f81c108eced16ff1f6b9b34037f14b248242ce34

  • SHA256

    8329f8176e926053fc9a4db2f9eb09aff6fec31c197e919ae26cb9501926c516

  • SHA512

    831f45b904b10454c5499c6b9888a9ea91ed632a1df15e9535661bcdd45c0365254dfae044cf6d1c2dc9d5fc39a533c139114b95e6b3d7abd712304968491d6c

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    173.237.185.61
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    7213575ace

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Luminosity 27 IoCs

    Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 110 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8329f8176e926053fc9a4db2f9eb09aff6fec31c197e919ae26cb9501926c516.exe
    "C:\Users\Admin\AppData\Local\Temp\8329f8176e926053fc9a4db2f9eb09aff6fec31c197e919ae26cb9501926c516.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Users\Admin\Documents\Binded Pred.exe
      "C:\Users\Admin\Documents\Binded Pred.exe"
      2⤵
      • Luminosity
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        3⤵
          PID:4092
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3300
      • C:\Users\Admin\AppData\Local\Temp\8329f8176e926053fc9a4db2f9eb09aff6fec31c197e919ae26cb9501926c516.exe
        "C:\Users\Admin\AppData\Local\Temp\8329f8176e926053fc9a4db2f9eb09aff6fec31c197e919ae26cb9501926c516.exe"
        2⤵
        • Suspicious behavior: RenamesItself
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2548
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:3840
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:4024
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1588
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1648
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2744
        • C:\Windows\SysWOW64\REG.exe
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
          3⤵
          • Adds Run key to start application
          PID:3780
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1216
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:488
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:3580
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2064
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:3420
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1744
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:3120
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2552
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2544
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1908
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2140
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:3924
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2444
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1956
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:3660
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:2736
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:3304
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1824
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          PID:1964
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Client Monitor" /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f /rl highest
          3⤵
          • Luminosity
          • Creates scheduled task(s)
          PID:3760

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3300-10-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/3300-8-0x0000000000400000-0x0000000000458000-memory.dmp

      Filesize

      352KB

    • memory/3540-6-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/4092-5-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/4092-3-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB