Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 01:42

General

  • Target

    07-30 B 周年稳定版)/打不开飞机-点击我启动飞机.bat

  • Size

    6KB

  • MD5

    f29563cfcfec1de3fe022b6dcf417abe

  • SHA1

    a1ccda74ca6a010aedf20b827031ec433c2a0af3

  • SHA256

    6c3fcc35e321e5accb37bb9bf52cc02eaf99dea6658c1f27efd77091fff60eff

  • SHA512

    c86b468a15922a9a99e8a534b18dc474b702de98309750f351016115753d48bb8588b1f9810436d4f3b9fdcbbe68e2c32b08189924511fcf25599ed0ff6a934e

  • SSDEEP

    24:9QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQj:XePJ1O32B8PNn

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\打不开飞机-点击我启动飞机.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Windows\system32\taskkill.exe
      taskkill /f /t /im Theplane.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\Theplane.exe
      Theplane.exe
      2⤵
      • Executes dropped EXE
      PID:4680
    • C:\Windows\system32\taskkill.exe
      taskkill /f /t /im Theplane.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2632
    • C:\Windows\system32\taskkill.exe
      taskkill /f /t /im Theplane.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3828
    • C:\Windows\system32\taskkill.exe
      taskkill /f /t /im conime.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4628
    • C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\Theplane.exe
      Theplane.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5116
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dnffeiji.com/dc.html
        3⤵
          PID:4524

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\Theplane.exe

      Filesize

      2.3MB

      MD5

      95b087f5151b5435fc9f17b944e7c452

      SHA1

      5577bfba78ea7e59d5945dcab7d55d3d3229e5d8

      SHA256

      96cb5bede9a55c7f94617809cfbfc11f242b8583c67191f38fb756cf3c05387b

      SHA512

      4e5082d9721ede9c268f35d3ef9d09a10328a8adcabebbe66fb5e2832180cab7c1617b758004c17f8f0732573396dbad440e22f4fbde495a744c83f91a74865e

    • C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\Theplane.exe

      Filesize

      2.3MB

      MD5

      95b087f5151b5435fc9f17b944e7c452

      SHA1

      5577bfba78ea7e59d5945dcab7d55d3d3229e5d8

      SHA256

      96cb5bede9a55c7f94617809cfbfc11f242b8583c67191f38fb756cf3c05387b

      SHA512

      4e5082d9721ede9c268f35d3ef9d09a10328a8adcabebbe66fb5e2832180cab7c1617b758004c17f8f0732573396dbad440e22f4fbde495a744c83f91a74865e

    • C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\Theplane.exe

      Filesize

      2.3MB

      MD5

      0b8397d39605face65f44790dc335e48

      SHA1

      37b6134664bafd0af06b5814a6c3dbd58ae95aad

      SHA256

      8e329415a2afc132160257df3c457624f407712fbcac236a1f2e2684f69dd6dc

      SHA512

      9ec399d13dc2e61771dc75af70c52a80f6d575d9af5fe16ed7880f3df98127e464087ad165893015b1e8a7e8b61f12b764c20cde254f0d1301dac94b012952fe

    • memory/5116-141-0x0000000000C50000-0x0000000000CC2000-memory.dmp

      Filesize

      456KB

    • memory/5116-142-0x0000000000C50000-0x0000000000CC2000-memory.dmp

      Filesize

      456KB

    • memory/5116-143-0x0000000000C50000-0x0000000000CC2000-memory.dmp

      Filesize

      456KB