Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/04/2024, 13:54

General

  • Target

    Invoice.exe

  • Size

    5.8MB

  • MD5

    e0ad1b070ad9c0430f491d07c2708484

  • SHA1

    f36de48706a23f38d7b3fa070d8948dbc9ac3491

  • SHA256

    647816ec76f04594da29576e94eb3febd405dd027379bc558b20babe65b11712

  • SHA512

    d7bea99b6595f75c0a448d93f8a1394d93a23d88933d3d26ba4c141faa69f9d87a18cf0535cb9e0e3016ad9067ade5320fc0171e7bbe84a42989bfd2f6c25ef9

  • SSDEEP

    98304:AuBV+GvjiaLzY5lk+Ar+fbleEfho0b6s0LSvIragO0fMvU/5Lf62LDY:AbGvPE5Ca183

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 10 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 9 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 13 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\Invoice.exe
      "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:2648
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
        3⤵
          PID:2904
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: SetClipboardViewer
          PID:2988
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"
          3⤵
            PID:1648
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
            3⤵
              PID:1524
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
                4⤵
                • Creates scheduled task(s)
                PID:980
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
              3⤵
                PID:2896
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"
              2⤵
                PID:784
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1388
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
                  3⤵
                  • Creates scheduled task(s)
                  PID:1628
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\Invoice.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
                2⤵
                  PID:1744
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {D3B182CE-FA53-4DD8-8EFC-34C7FCF01B65} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
                1⤵
                  PID:1452
                  • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
                    C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2304
                    • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
                      "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious behavior: SetClipboardViewer
                      PID:2824
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"
                      3⤵
                        PID:2124
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
                        3⤵
                          PID:2276
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
                            4⤵
                            • Creates scheduled task(s)
                            PID:1676
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
                          3⤵
                            PID:1680

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\holderwb.txt

                        Filesize

                        2B

                        MD5

                        f3b25701fe362ec84616a93a45ce9998

                        SHA1

                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                        SHA256

                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                        SHA512

                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                      • C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

                        Filesize

                        3.0MB

                        MD5

                        536441b93db2dcf06f8d19eb6c11899b

                        SHA1

                        c26f15db010956a21bc15c1155b9c82a3e2274fd

                        SHA256

                        9b04247046aa7d0854bcc1ab79fbc88963e7bf50f033ef1434561476b7f91912

                        SHA512

                        05513f0e424f1d80e136d3e6cfb5d992d57d960f18ca0c2d60cd8050b390b25ee15be2202a9c8d16789f807e46457a353450815d63a3d2493f93ff1f0964c926

                      • \Users\Admin\AppData\Local\Temp\svchost.exe

                        Filesize

                        3.0MB

                        MD5

                        646f6ea76cd0f29d4c2d6b0c8935e39e

                        SHA1

                        59962777a41b8ca3dfd0c40147e013a3a6d9bda4

                        SHA256

                        0f71486baf108292e78215a8ca9643408664ecf173a6d556185c784297fc2ac5

                        SHA512

                        480044c8f611ead3ba8351f4e580fe191f3b7a8dfa2ab513a3caf6a3927d9997d9a3c77ae2e26c7ffa26d1569d8d2ecec235deca23b389b491237a1cca5d9442

                      • memory/872-79-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/872-56-0x0000000000650000-0x0000000000668000-memory.dmp

                        Filesize

                        96KB

                      • memory/872-54-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/872-32-0x0000000000CC0000-0x0000000000FC4000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/872-33-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/1320-39-0x0000000000550000-0x0000000000558000-memory.dmp

                        Filesize

                        32KB

                      • memory/1320-46-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/1320-25-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

                        Filesize

                        256KB

                      • memory/1320-23-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-20-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-5-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-14-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-15-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-55-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

                        Filesize

                        256KB

                      • memory/1320-24-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/1320-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/1320-7-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-6-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-9-0x0000000000080000-0x0000000000108000-memory.dmp

                        Filesize

                        544KB

                      • memory/1320-42-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

                        Filesize

                        256KB

                      • memory/1320-47-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2220-3-0x0000000005020000-0x0000000005060000-memory.dmp

                        Filesize

                        256KB

                      • memory/2220-0-0x0000000000E60000-0x0000000001426000-memory.dmp

                        Filesize

                        5.8MB

                      • memory/2220-2-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2220-4-0x00000000057D0000-0x0000000005B56000-memory.dmp

                        Filesize

                        3.5MB

                      • memory/2220-36-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2220-1-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2304-86-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2304-101-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2304-84-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2304-85-0x00000000011D0000-0x00000000014D4000-memory.dmp

                        Filesize

                        3.0MB

                      • memory/2304-87-0x0000000001180000-0x00000000011C0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2648-45-0x0000000000400000-0x000000000041B000-memory.dmp

                        Filesize

                        108KB

                      • memory/2648-40-0x0000000000400000-0x000000000041B000-memory.dmp

                        Filesize

                        108KB

                      • memory/2648-43-0x0000000000400000-0x000000000041B000-memory.dmp

                        Filesize

                        108KB

                      • memory/2648-44-0x0000000000400000-0x000000000041B000-memory.dmp

                        Filesize

                        108KB

                      • memory/2824-103-0x0000000004D10000-0x0000000004D50000-memory.dmp

                        Filesize

                        256KB

                      • memory/2824-92-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2824-100-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2824-102-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2904-48-0x0000000000400000-0x0000000000458000-memory.dmp

                        Filesize

                        352KB

                      • memory/2904-52-0x0000000000400000-0x0000000000458000-memory.dmp

                        Filesize

                        352KB

                      • memory/2904-50-0x0000000000400000-0x0000000000458000-memory.dmp

                        Filesize

                        352KB

                      • memory/2988-68-0x0000000000400000-0x0000000000418000-memory.dmp

                        Filesize

                        96KB

                      • memory/2988-80-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2988-81-0x0000000000B70000-0x0000000000BB0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2988-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2988-75-0x0000000000B70000-0x0000000000BB0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2988-73-0x0000000000400000-0x0000000000418000-memory.dmp

                        Filesize

                        96KB

                      • memory/2988-71-0x0000000000400000-0x0000000000418000-memory.dmp

                        Filesize

                        96KB

                      • memory/2988-62-0x0000000000400000-0x0000000000418000-memory.dmp

                        Filesize

                        96KB

                      • memory/2988-58-0x0000000000400000-0x0000000000418000-memory.dmp

                        Filesize

                        96KB

                      • memory/2988-60-0x0000000000400000-0x0000000000418000-memory.dmp

                        Filesize

                        96KB

                      • memory/2988-64-0x0000000000400000-0x0000000000418000-memory.dmp

                        Filesize

                        96KB

                      • memory/2988-74-0x0000000074ED0000-0x00000000755BE000-memory.dmp

                        Filesize

                        6.9MB