Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

TL.exe

windows10-1703-x64

4

Analysis

  • max time kernel
    110s
  • max time network
    93s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/03/2023, 00:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TL.exe

  • Size

    399KB

  • MD5

    96c64d11cf26ebd227ad754b62d480ae

  • SHA1

    cb40090b892c34feb8ceb995a0d0b90ecfe54acf

  • SHA256

    2b11f487e853e952dc677071202cbe25d6800ccaf3f93a3232c5eed715a1c033

  • SHA512

    0be0c2b657ba8814112a9ea075e1ec6c6a0fb965c7308ba24e40b98ec90e9e60afbe09328c0f6c3aa27b54762bf880dfec4aee5f20d24c3b644288e0be311d5f

  • SSDEEP

    6144:zQQh9jpDxUC6eVy9QetdHZwJvJMxhnel93mdQoCX:Nh99yIVjAFZwJxEh

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 19 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TL.exe
    "C:\Users\Admin\AppData\Local\Temp\TL.exe"
    1⤵
      PID:4192
    • C:\Windows\System32\SystemSettingsBroker.exe
      C:\Windows\System32\SystemSettingsBroker.exe -Embedding
      1⤵
        PID:3500
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:1084
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:1940
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:5028
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:4492
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s RasMan
            1⤵
              PID:4504
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s RasMan
              1⤵
                PID:2404
              • C:\Windows\system32\control.exe
                "C:\Windows\system32\control.exe" netconnections
                1⤵
                • Modifies registry class
                PID:2480
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s Netman
                1⤵
                • Modifies data under HKEY_USERS
                PID:800
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc
                1⤵
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:424
              • C:\Windows\System32\rundll32.exe
                "C:\Windows\System32\rundll32.exe" devmgr.dll,DeviceProperties_RunDLL /DeviceId "PCI\VEN_10EC&DEV_8139&SUBSYS_11001AF4&REV_20\3&11583659&0&18"
                1⤵
                  PID:404
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:1804

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Windows\INF\netrasa.PNF
                    Filesize

                    22KB

                    MD5

                    80648b43d233468718d717d10187b68d

                    SHA1

                    a1736e8f0e408ce705722ce097d1adb24ebffc45

                    SHA256

                    8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

                    SHA512

                    eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

                    Download Submit

                  • C:\Windows\INF\netsstpa.PNF
                    Filesize

                    6KB

                    MD5

                    01e21456e8000bab92907eec3b3aeea9

                    SHA1

                    39b34fe438352f7b095e24c89968fca48b8ce11c

                    SHA256

                    35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

                    SHA512

                    9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

                    Download Submit

                  • memory/4192-120-0x0000000000400000-0x0000000000472000-memory.dmp

                    Filesize

                    456KB

                    Download

                  • memory/4192-121-0x0000000000400000-0x0000000000472000-memory.dmp

                    Filesize

                    456KB

                    Download