Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7cfd8176a5...3b.exe

windows7_x64

10

7cfd8176a5...3b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    139s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01/07/2022, 05:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7cfd8176a561d17895afb532af1b04ebcba28aed056ce03a46a22bb069954c3b.exe

  • Size

    1011KB

  • MD5

    98119cf7e92697a623d6d186ddca94d9

  • SHA1

    4190ebf1ba1ae0941b8b52c5968e6206ec0570cb

  • SHA256

    7cfd8176a561d17895afb532af1b04ebcba28aed056ce03a46a22bb069954c3b

  • SHA512

    c5675f6ae548148785b7b34498952f49bcebd82e966e47ff2f3bc0785534ff6a17f54750a53040777755d16962f3cbd5a1269f203682ac720e89fac4e1c9eeab

Score
10/10
agentteslahawkeye_rebornm00nd3v_loggerxpertrattestcollectionevasioninfostealerkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    chibu1985
Mutex

18510a81-4a2c-46b6-8ff6-1badb284d4f1

Attributes
  • fields

    map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:chibu1985 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.yandex.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:18510a81-4a2c-46b6-8ff6-1badb284d4f1 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]

  • name

    HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Extracted

Family

xpertrat

Version

3.0.10

Botnet

Test

C2

obystar.duckdns.org:1867

Mutex

T4Y8R5C3-R0I7-T7W6-F224-N7V6O4W0K7K6

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • XpertRAT

    XpertRAT is a remote access trojan with various capabilities.

    ratxpertrat
  • XpertRAT Core Payload 3 IoCs
  • M00nD3v Logger Payload 2 IoCs

    Detects M00nD3v Logger payload in memory.

    infostealer
  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cfd8176a561d17895afb532af1b04ebcba28aed056ce03a46a22bb069954c3b.exe
    "C:\Users\Admin\AppData\Local\Temp\7cfd8176a561d17895afb532af1b04ebcba28aed056ce03a46a22bb069954c3b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: SetClipboardViewer
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:3308
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\za1.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\za1.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: SetClipboardViewer
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1AEA.tmp"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2848
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1EF3.tmp"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:1356
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\server.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\server.exe"
        3⤵
        • UAC bypass
        • Windows security bypass
        • Executes dropped EXE
        • Windows security modification
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1984
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\server.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\server.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4256

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1AEA.tmp
    Filesize

    4KB

    MD5

    bdf65f70610625cc771c5cc7ce168c7d

    SHA1

    a8829b1c071ed0521d11925a98468c12a53a03b8

    SHA256

    b66236dd86f140ca02db0c296e45032b272de2895c4f047a562e73bc8395dba5

    SHA512

    add2db50b0440b07ecc48a5fde7f0b72e84b76f11ea060944afa28ddd03791e6adb3bfca704254131fb3f591f484b37f7276fab96b0c4776a27cb526bcf5f3a4

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\server.exe
    Filesize

    172KB

    MD5

    cc3710d2ed254a11a28c583db30d7861

    SHA1

    e5a2634a0c2468505cd0615d8b8eab723a08e774

    SHA256

    28afa5adbd947802b9800aa673921ce36b47a4fdf1c252982ddddb136279a762

    SHA512

    5ee5fe6a7742008f1d3734d3117256552ebb3e1cdb98f3a3ba3ef6d7508603a9eb246902190221390eac01d6c8d5d80a8e0b3a1fbae17f6e7a134cc5ab3cc6d0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\server.exe
    Filesize

    172KB

    MD5

    cc3710d2ed254a11a28c583db30d7861

    SHA1

    e5a2634a0c2468505cd0615d8b8eab723a08e774

    SHA256

    28afa5adbd947802b9800aa673921ce36b47a4fdf1c252982ddddb136279a762

    SHA512

    5ee5fe6a7742008f1d3734d3117256552ebb3e1cdb98f3a3ba3ef6d7508603a9eb246902190221390eac01d6c8d5d80a8e0b3a1fbae17f6e7a134cc5ab3cc6d0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\server.exe
    Filesize

    172KB

    MD5

    cc3710d2ed254a11a28c583db30d7861

    SHA1

    e5a2634a0c2468505cd0615d8b8eab723a08e774

    SHA256

    28afa5adbd947802b9800aa673921ce36b47a4fdf1c252982ddddb136279a762

    SHA512

    5ee5fe6a7742008f1d3734d3117256552ebb3e1cdb98f3a3ba3ef6d7508603a9eb246902190221390eac01d6c8d5d80a8e0b3a1fbae17f6e7a134cc5ab3cc6d0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\za1.exe
    Filesize

    553KB

    MD5

    890f43e17c881cf0e1acfb7d7b9f5f21

    SHA1

    c83a42f122c62d0f2589789822444a0694077e74

    SHA256

    3cf0a56f43389b6d627e8c83cac66f7916d79c218b5712e90b86863143cbbbd9

    SHA512

    a1c63d9f365e790374bfe5746181e06fef60307724a633a79b4115c829e7699747ade166fe16c07f448b1f73634b6a4007ef633b2356bef5dfab9b6ec5192961

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\za1.exe
    Filesize

    553KB

    MD5

    890f43e17c881cf0e1acfb7d7b9f5f21

    SHA1

    c83a42f122c62d0f2589789822444a0694077e74

    SHA256

    3cf0a56f43389b6d627e8c83cac66f7916d79c218b5712e90b86863143cbbbd9

    SHA512

    a1c63d9f365e790374bfe5746181e06fef60307724a633a79b4115c829e7699747ade166fe16c07f448b1f73634b6a4007ef633b2356bef5dfab9b6ec5192961

    Download Submit

  • memory/1356-159-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1356-161-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1356-162-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1356-163-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1636-151-0x0000000074CE0000-0x0000000075291000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1636-148-0x0000000074CE0000-0x0000000075291000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2848-153-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/2848-155-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/2848-156-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/3308-134-0x0000000074CE0000-0x0000000075291000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3308-133-0x0000000074CE0000-0x0000000075291000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4256-150-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/4256-144-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/4312-130-0x0000000000BC0000-0x0000000000CC2000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/4312-131-0x0000000005AB0000-0x0000000005FDC000-memory.dmp

    Filesize

    5.2MB

    Download