Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
99s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21/05/2022, 18:54 UTC
General
-
Target
Company profile.exe
-
Size
716KB
-
MD5
16f704634dd7855cf929214dfaeaa9e8
-
SHA1
e7af55b75a431c30265b7a63162611c44cfef296
-
SHA256
e4e29eef439bf36287f9dc660155697cc2d227fbccd34d95a8b59c5451ba5287
-
SHA512
8472440832759e87529151606aecc9cf4696f51c32cf4b9d6b338283bc6c937b0755dd945faa73baf36df1786030042a97883178f0d50db1fa57d160b12761a9
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 32 IoCs
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 15 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Company profile.exe"C:\Users\Admin\AppData\Local\Temp\Company profile.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Company profile.exe"C:\Users\Admin\AppData\Local\Temp\Company profile.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
-
DNSapi.ipify.orgRemote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN CNAMEapi.ipify.org.herokudns.comapi.ipify.org.herokudns.comIN A52.20.78.240api.ipify.org.herokudns.comIN A3.232.242.170api.ipify.org.herokudns.comIN A54.91.59.199api.ipify.org.herokudns.comIN A3.220.57.224 -
GEThttp://api.ipify.org/Remote address:52.20.78.240:80RequestGET / HTTP/1.1
Host: api.ipify.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Server: Cowboy
Connection: keep-alive
Content-Type: text/plain
Vary: Origin
Date: Sat, 21 May 2022 18:55:27 GMT
Content-Length: 12
Via: 1.1 vegur
-
DNSmail.chemshire.orgRemote address:8.8.8.8:53Requestmail.chemshire.orgIN AResponse
-
52.20.78.240:80http://api.ipify.org/http
HTTP Request
GET http://api.ipify.org/HTTP Response
200
-
8.8.8.8:53api.ipify.orgdns
DNS Request
api.ipify.org
DNS Response
52.20.78.2403.232.242.17054.91.59.1993.220.57.224
-
8.8.8.8:53mail.chemshire.orgdns
DNS Request
mail.chemshire.org
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
272KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
744KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
648KB
-
Filesize
32KB