Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 10:18

General

  • Target

    PLogger+V5.0/patch.exe

  • Size

    212KB

  • MD5

    6c4e602268e4b8bd575b7db917e48831

  • SHA1

    870ff297863a9248b5a12339a38328eed6390d13

  • SHA256

    26dbe46819c4271f45c830b3d214e513f9b27722c337ffd76cb2c3a719794740

  • SHA512

    b9a6a9b626b27d5002496fa5ca15307e021e339d18b89dbf2bdf03915a6693feb28100fc7ae8eb946caa7d00057d7a1160a35d26f1ef32515c8b4e0ae12ea71e

  • SSDEEP

    3072:0X3djKBqb240NW1qzmgqojoJlS5OzNSLBS9sqLFm+kVXslJMsgE:0X3IWTqzmgoJlS5Oz4BS9sqLFuV8j

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    parsa123456nnn

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PLogger+V5.0\patch.exe
    "C:\Users\Admin\AppData\Local\Temp\PLogger+V5.0\patch.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      2⤵
      • Drops file in Drivers directory
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

    Filesize

    56B

    MD5

    c356a02c7f1a1918794aef71af9b4b2c

    SHA1

    6de454586b976a4adafb43de81fe706b0b93a949

    SHA256

    fae91d54033d51368550f98b10bf7ffc6c54db3a7c2a09c735a3b41f017fd2e7

    SHA512

    a1c388cc46b6a656f8e116d99568c117279dfb96c322ddaafb4a0a4bb5b9dd208e7fb8a9815c85d1aa988702ccfba419fd5d566f1aa500a486a2fe6e25fc1d5f

  • C:\Users\Admin\AppData\Roaming\Windows Update.exe

    Filesize

    212KB

    MD5

    6c4e602268e4b8bd575b7db917e48831

    SHA1

    870ff297863a9248b5a12339a38328eed6390d13

    SHA256

    26dbe46819c4271f45c830b3d214e513f9b27722c337ffd76cb2c3a719794740

    SHA512

    b9a6a9b626b27d5002496fa5ca15307e021e339d18b89dbf2bdf03915a6693feb28100fc7ae8eb946caa7d00057d7a1160a35d26f1ef32515c8b4e0ae12ea71e

  • memory/804-24-0x000000001D830000-0x000000001D8CC000-memory.dmp

    Filesize

    624KB

  • memory/804-30-0x00000000018A0000-0x00000000018B0000-memory.dmp

    Filesize

    64KB

  • memory/804-37-0x00000000018A0000-0x00000000018B0000-memory.dmp

    Filesize

    64KB

  • memory/804-36-0x00000000018A0000-0x00000000018B0000-memory.dmp

    Filesize

    64KB

  • memory/804-35-0x00000000018A0000-0x00000000018B0000-memory.dmp

    Filesize

    64KB

  • memory/804-19-0x00007FF9F9560000-0x00007FF9F9F01000-memory.dmp

    Filesize

    9.6MB

  • memory/804-20-0x00000000018A0000-0x00000000018B0000-memory.dmp

    Filesize

    64KB

  • memory/804-21-0x00007FF9F9560000-0x00007FF9F9F01000-memory.dmp

    Filesize

    9.6MB

  • memory/804-25-0x000000001D0F0000-0x000000001D118000-memory.dmp

    Filesize

    160KB

  • memory/804-34-0x00007FF9F9560000-0x00007FF9F9F01000-memory.dmp

    Filesize

    9.6MB

  • memory/804-26-0x000000001D0C0000-0x000000001D0C8000-memory.dmp

    Filesize

    32KB

  • memory/804-29-0x000000001EF30000-0x000000001F23E000-memory.dmp

    Filesize

    3.1MB

  • memory/804-23-0x000000001D190000-0x000000001D1F2000-memory.dmp

    Filesize

    392KB

  • memory/804-27-0x000000001DCA0000-0x000000001DCEC000-memory.dmp

    Filesize

    304KB

  • memory/804-28-0x00000000018A0000-0x00000000018B0000-memory.dmp

    Filesize

    64KB

  • memory/3424-1-0x000000001C3E0000-0x000000001C8AE000-memory.dmp

    Filesize

    4.8MB

  • memory/3424-4-0x0000000001930000-0x0000000001940000-memory.dmp

    Filesize

    64KB

  • memory/3424-2-0x00007FF9F9560000-0x00007FF9F9F01000-memory.dmp

    Filesize

    9.6MB

  • memory/3424-18-0x00007FF9F9560000-0x00007FF9F9F01000-memory.dmp

    Filesize

    9.6MB

  • memory/3424-0-0x00007FF9F9560000-0x00007FF9F9F01000-memory.dmp

    Filesize

    9.6MB

  • memory/3424-3-0x000000001CA50000-0x000000001CAF6000-memory.dmp

    Filesize

    664KB