Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2023, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe
-
Size
1.5MB
-
MD5
6419a1e59348225baafa1b58ed611fc9
-
SHA1
89e4e06f33ddacf9092907bca221ad111fd4dcf1
-
SHA256
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df
-
SHA512
0d85752488eedc84c3bc858e171a1b73ffda869b14b9404e121f5a71cbb4aa64510b51a57890fe3d97ccd9beab854361e009e27e1cc4796f5d5c7bdba36c0634
-
SSDEEP
24576:twFgDyuHZ0uHO/dqvTrHxm/vDlDLIgNgOknWH:phHZ02O/dGc9UgbsY
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
bc1q7lqwyshs9zjpxyhcvwpmfyhad4w7j08qa7yudz
0x0BE5856fBfb983d813E9C8104a9FEE482F9B1b57
Signatures
-
Detects Eternity clipper 1 IoCs
resource yara_rule behavioral2/memory/1984-25-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/5052-20-0x0000000000400000-0x000000000045A000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
pid Process 4508 InstallUtil.exe 1248 InstallUtil.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 760 set thread context of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 3948 set thread context of 5052 3948 InstallUtil.exe 101 PID 760 set thread context of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5036 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4184 PING.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 3948 InstallUtil.exe 3948 InstallUtil.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 3948 InstallUtil.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 5052 InstallUtil.exe 5052 InstallUtil.exe 5052 InstallUtil.exe 5052 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe Token: SeDebugPrivilege 3948 InstallUtil.exe Token: SeDebugPrivilege 5052 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3924 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 94 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3948 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 95 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 3612 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 99 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 760 wrote to memory of 4372 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 100 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 3948 wrote to memory of 5052 3948 InstallUtil.exe 101 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 2980 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 102 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 760 wrote to memory of 1984 760 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 103 PID 1984 wrote to memory of 5032 1984 InstallUtil.exe 104 PID 1984 wrote to memory of 5032 1984 InstallUtil.exe 104 PID 1984 wrote to memory of 5032 1984 InstallUtil.exe 104 PID 5032 wrote to memory of 3780 5032 cmd.exe 106 PID 5032 wrote to memory of 3780 5032 cmd.exe 106 PID 5032 wrote to memory of 3780 5032 cmd.exe 106 PID 5032 wrote to memory of 4184 5032 cmd.exe 107 PID 5032 wrote to memory of 4184 5032 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe"C:\Users\Admin\AppData\Local\Temp\189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:3924
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:3612
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:4372
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:2980
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:3780
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:4184
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:5036
-
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"4⤵
- Executes dropped EXE
PID:4508
-
-
-
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeC:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe1⤵
- Executes dropped EXE
PID:1248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
Filesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
Filesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159