Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 23:01

General

  • Target

    443_654.one

  • Size

    117KB

  • MD5

    df1f29624394dc9466a59bce80a2e8d2

  • SHA1

    56f95cd319944ed2bf59a3aac7da8e0b421d424e

  • SHA256

    ac395e800318c64e376e897a38c0defcc7b78aa5439d8431a38c2e05377e49aa

  • SHA512

    683d392f3497bd9af9f71cd7561547eb685a38149fa99ab6bc6019233a8f9caae10a7ed60037589f4703f194b1d39ece683a3f250dc79a6c960a2d1400ec915e

  • SSDEEP

    1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXO:1BoC+tCYvSMVnte8ZP1Y6Je

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\443_654.one"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{16A8E445-FADF-41F1-B58D-4DDB4484A50F}\NT\0\click.wsf"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{16A8E445-FADF-41F1-B58D-4DDB4484A50F}\NT\0\radFD1B4.tmp.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NnCxReVpCIKTEsa\wkLPVZvnRqh.dll"
          4⤵
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          PID:1136

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.bin

    Filesize

    53KB

    MD5

    ae25f2104967b2708ac9dba80aac52fd

    SHA1

    7ac0150b43cbb5eeba9a0f956e1291df6790f3bf

    SHA256

    11b3d1564b12934489281250c9a683f076fe10254bfdd7da72307e538838ec56

    SHA512

    d4a7f95631e7eb88fdadbe66d31bf9c7459d0f80ca2c9174952aad42bff6262241b25916e6a089f778990be981a2cf220baa69ad261314247c286397553decca

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.bin

    Filesize

    567B

    MD5

    d055ce625528e448c61315eaaef5bb71

    SHA1

    029df4c872b1c154f32e7fe94f434547c3ba6192

    SHA256

    85bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705

    SHA512

    705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.bin

    Filesize

    48KB

    MD5

    b7fc313714edd7866f4c76527282c2b5

    SHA1

    c86217b46956933fae4a30483a63b33f34b8c503

    SHA256

    b6d25f5eb52d5c24ef6c325bd25f18e413f3e23d20413a3693749275ba4b192c

    SHA512

    038a73b7a69dd976c964f1538f5b4f7c6c64721e4f2f1a831815598faae84cac53305c03f5cea6e66acdc110a9a5117eee191345ea004b9576c752122f8d88f7

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BP.bin

    Filesize

    9B

    MD5

    07f5a0cffd9b2616ea44fb90ccc04480

    SHA1

    641b12c5ffa1a31bc367390e34d441a9ce1958ee

    SHA256

    a0430a038e7d879375c9ca5bf94cb440a3b9a002712118a7bccc1ff82f1ea896

    SHA512

    09e7488c138dead45343a79ad0cb37036c5444606cdfd8aa859ee70227a96964376a17f07e03d0fc353708ca9aaf979abf8bc917e6c2d005a0052575e074f531

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{16A8E445-FADF-41F1-B58D-4DDB4484A50F}\NT\0\click.wsf

    Filesize

    53KB

    MD5

    ae25f2104967b2708ac9dba80aac52fd

    SHA1

    7ac0150b43cbb5eeba9a0f956e1291df6790f3bf

    SHA256

    11b3d1564b12934489281250c9a683f076fe10254bfdd7da72307e538838ec56

    SHA512

    d4a7f95631e7eb88fdadbe66d31bf9c7459d0f80ca2c9174952aad42bff6262241b25916e6a089f778990be981a2cf220baa69ad261314247c286397553decca

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{16A8E445-FADF-41F1-B58D-4DDB4484A50F}\NT\0\click.wsf

    Filesize

    9B

    MD5

    07f5a0cffd9b2616ea44fb90ccc04480

    SHA1

    641b12c5ffa1a31bc367390e34d441a9ce1958ee

    SHA256

    a0430a038e7d879375c9ca5bf94cb440a3b9a002712118a7bccc1ff82f1ea896

    SHA512

    09e7488c138dead45343a79ad0cb37036c5444606cdfd8aa859ee70227a96964376a17f07e03d0fc353708ca9aaf979abf8bc917e6c2d005a0052575e074f531

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{16A8E445-FADF-41F1-B58D-4DDB4484A50F}\NT\0\radFD1B4.tmp.dll

    Filesize

    309KB

    MD5

    bfc060937dc90b273eccb6825145f298

    SHA1

    c156c00c7e918f0cb7363614fb1f177c90d8108a

    SHA256

    2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253

    SHA512

    cc1fee19314b0a0f9e292fa84f6e98f087033d77db937848dda1da0c88f49997866cba5465df04bf929b810b42fdb81481341064c4565c9b6272fa7f3b473ac5

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{16A8E445-FADF-41F1-B58D-4DDB4484A50F}\NT\0\radFD1B4.tmp.dll

    Filesize

    309KB

    MD5

    bfc060937dc90b273eccb6825145f298

    SHA1

    c156c00c7e918f0cb7363614fb1f177c90d8108a

    SHA256

    2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253

    SHA512

    cc1fee19314b0a0f9e292fa84f6e98f087033d77db937848dda1da0c88f49997866cba5465df04bf929b810b42fdb81481341064c4565c9b6272fa7f3b473ac5

  • C:\Windows\System32\NnCxReVpCIKTEsa\wkLPVZvnRqh.dll

    Filesize

    309KB

    MD5

    bfc060937dc90b273eccb6825145f298

    SHA1

    c156c00c7e918f0cb7363614fb1f177c90d8108a

    SHA256

    2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253

    SHA512

    cc1fee19314b0a0f9e292fa84f6e98f087033d77db937848dda1da0c88f49997866cba5465df04bf929b810b42fdb81481341064c4565c9b6272fa7f3b473ac5

  • memory/1392-139-0x00007FFBAF200000-0x00007FFBAF210000-memory.dmp

    Filesize

    64KB

  • memory/1392-138-0x00007FFBAF200000-0x00007FFBAF210000-memory.dmp

    Filesize

    64KB

  • memory/1392-137-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

    Filesize

    64KB

  • memory/1392-136-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

    Filesize

    64KB

  • memory/1392-133-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

    Filesize

    64KB

  • memory/1392-135-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

    Filesize

    64KB

  • memory/1392-134-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

    Filesize

    64KB

  • memory/1836-191-0x0000000001EF0000-0x0000000001F1D000-memory.dmp

    Filesize

    180KB

  • memory/1836-194-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

    Filesize

    4KB