Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
16/09/2022, 22:40
General
-
Target
9115677abd44ce89dde29c1b9bddeffff32ba6c8c7bac42090facf075eb487fd.exe
-
Size
300KB
-
MD5
07c209d0c5735ccb40e429f9296eb277
-
SHA1
d1b451db40f173f5310126cbd8284147ec5eda02
-
SHA256
9115677abd44ce89dde29c1b9bddeffff32ba6c8c7bac42090facf075eb487fd
-
SHA512
747127ce8377c974158181d52392bff265351ec179767b40cca05f49b99d369343f8c3e26694364df210255fb3e2556f412026293241861115cd53a51f834aca
-
SSDEEP
6144:vwnsL5FbOB5jzO9cgNJvEb0I5nigabwVf:IsNFKXja9ZvTI5i
Malware Config
Extracted
danabot
103.144.139.228:443
213.227.154.98:443
66.85.147.23:443
153.92.223.225:443
-
embedded_hash
A64A3A6ED13022027B84C77D31BE0C74
-
type
loader
Signatures
-
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9115677abd44ce89dde29c1b9bddeffff32ba6c8c7bac42090facf075eb487fd.exe"C:\Users\Admin\AppData\Local\Temp\9115677abd44ce89dde29c1b9bddeffff32ba6c8c7bac42090facf075eb487fd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8DB9.exeC:\Users\Admin\AppData\Local\Temp\8DB9.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Etfrehti.dll,start C:\Users\Admin\AppData\Local\Temp\8DB9.exe2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141023⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 5082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4828 -ip 48281⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD57daa71c2b7cfd89fd90d09754c57060f
SHA1fd9cb190360eb5518b8480530bf1b0c5cb8d9256
SHA2562cbbf29f2b68edcbae03779cddf46e361de1eb162d9676777e89878b76c23ce9
SHA512aaee953da7a7ed498809cb332381072fa09d405d1e9d975660e1f942725a87b367e409286089d4bf46ac63c9ec63ad78c12a8de5129e573cc5d480b6c427e8af
-
Filesize
1.9MB
MD57daa71c2b7cfd89fd90d09754c57060f
SHA1fd9cb190360eb5518b8480530bf1b0c5cb8d9256
SHA2562cbbf29f2b68edcbae03779cddf46e361de1eb162d9676777e89878b76c23ce9
SHA512aaee953da7a7ed498809cb332381072fa09d405d1e9d975660e1f942725a87b367e409286089d4bf46ac63c9ec63ad78c12a8de5129e573cc5d480b6c427e8af
-
Filesize
2.5MB
MD5d7a66ca4622307cefbaf2d548edf21c1
SHA1d6e7396cf81fddc86bd9a6adb17dbec09fbd532d
SHA256c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d
SHA5124d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c
-
Filesize
2.5MB
MD5d7a66ca4622307cefbaf2d548edf21c1
SHA1d6e7396cf81fddc86bd9a6adb17dbec09fbd532d
SHA256c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d
SHA5124d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c
-
Filesize
2.5MB
MD5d7a66ca4622307cefbaf2d548edf21c1
SHA1d6e7396cf81fddc86bd9a6adb17dbec09fbd532d
SHA256c692330b06a1c232eafe7e68f867c6f339ca9545834010b0997e19f936ad0b5d
SHA5124d9e5fa064ea98af43d5fef363a69a593fdd0ae5f4b79db0794bd5b12e9ffd0c52bb53b7c7b08141f4a33ea7b786f2164504af3295ee9466477270e69b87f41c
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.6MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.7MB
-
Filesize
68KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
36KB