Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
72s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21/05/2022, 12:19 UTC
General
-
Target
PO#052620.exe
-
Size
916KB
-
MD5
6b9b5794e44f69ab2773ce2799463454
-
SHA1
5ae3669ecff1e3de5569d81a0c4bae495e4be457
-
SHA256
9c5b8535e2ac554768c5cfc3d655a3aed7647fe2280e66161a516296eb5a5918
-
SHA512
b5d666a93bd724e010fc63f5d70078c54a7a8bebf6aab647ad2a49d049d99703ac14ba2b7fe408632eef308d85af5b2725e89c18e193f2966ff0cb1b72460731
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\AEF946DCB4\Log.txt
masslogger
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
don8@intarscan.org - Password:
?qlva43X~o%I
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#052620.exe"C:\Users\Admin\AppData\Local\Temp\PO#052620.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
-
DNSapi.ipify.orgRemote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN CNAMEapi.ipify.org.herokudns.comapi.ipify.org.herokudns.comIN A52.20.78.240api.ipify.org.herokudns.comIN A3.220.57.224api.ipify.org.herokudns.comIN A3.232.242.170api.ipify.org.herokudns.comIN A54.91.59.199 -
GEThttp://api.ipify.org/Remote address:52.20.78.240:80RequestGET / HTTP/1.1
Host: api.ipify.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Server: Cowboy
Connection: keep-alive
Content-Type: text/plain
Vary: Origin
Date: Sat, 21 May 2022 12:31:12 GMT
Content-Length: 12
Via: 1.1 vegur
-
DNSus2.smtp.mailhostbox.comRemote address:8.8.8.8:53Requestus2.smtp.mailhostbox.comIN AResponseus2.smtp.mailhostbox.comIN A208.91.198.46us2.smtp.mailhostbox.comIN A162.222.225.29us2.smtp.mailhostbox.comIN A208.91.198.38us2.smtp.mailhostbox.comIN A162.222.225.16
-
52.20.78.240:80http://api.ipify.org/http
HTTP Request
GET http://api.ipify.org/HTTP Response
200 -
208.91.198.46:587us2.smtp.mailhostbox.comsmtp
-
8.8.8.8:53api.ipify.orgdns
DNS Request
api.ipify.org
DNS Response
52.20.78.2403.220.57.2243.232.242.17054.91.59.199
-
8.8.8.8:53us2.smtp.mailhostbox.comdns
DNS Request
us2.smtp.mailhostbox.com
DNS Response
208.91.198.46162.222.225.29208.91.198.38162.222.225.16
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
272KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
696KB
-
Filesize
32KB