Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

Screenshot...37.png

windows10-1703-x64

Resubmissions

18/04/2023, 13:47

230418-q3j8ysbg55 6

18/04/2023, 13:46

230418-q26essbg48 3

18/04/2023, 13:44

230418-q13yaabg33 4

18/04/2023, 13:41

230418-qy82hsbf99 3

18/04/2023, 13:20

230418-qk6dgabf28 3

18/04/2023, 13:18

230418-qkb5madd4z 3

18/04/2023, 08:57

230418-kwzgeaae48 3

18/04/2023, 08:54

230418-kva3escc3x 3

Analysis

  • max time kernel
    63s
  • max time network
    77s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/04/2023, 13:44

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Screenshot 2022-06-21 14.46.37.png

  • Size

    89KB

  • MD5

    3db0b4a9231860087b407ab8e85f1877

  • SHA1

    d7baf924e1778fe9637a35f1c751f33a9de74ab9

  • SHA256

    022f3a5067ebcfad464cb62ae1326f82889cfbdb1f57409bec7ebb107dd8debf

  • SHA512

    3b335c49df321d587a800650443c4338dcdbf18baa40832a2a515f2f525f0a099fde70014c6200206cb9c710843f535ec3d03abcddb56f8363e5c0da55163e24

  • SSDEEP

    1536:OPgXyMXGRgughoErwSze6a1pzwFpHojLnZjAxYSBruStd0M+fQM/kB3QudKT8tCX:OOyMXG8aErizn8+tYD+fzuguna

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2022-06-21 14.46.37.png"
    1⤵
      PID:1008
    • C:\Windows\System32\SystemSettingsBroker.exe
      C:\Windows\System32\SystemSettingsBroker.exe -Embedding
      1⤵
        PID:3180
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:4808
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:4760
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3948
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:4124
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s RasMan
            1⤵
              PID:4964
            • C:\Windows\system32\LogonUI.exe
              "LogonUI.exe" /flags:0x0 /state0:0xa3ae1055 /state1:0x41c64e6d
              1⤵
                PID:4804

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Windows\INF\netrasa.PNF
                Filesize

                22KB

                MD5

                80648b43d233468718d717d10187b68d

                SHA1

                a1736e8f0e408ce705722ce097d1adb24ebffc45

                SHA256

                8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

                SHA512

                eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

                Download Submit

              • C:\Windows\INF\netsstpa.PNF
                Filesize

                6KB

                MD5

                01e21456e8000bab92907eec3b3aeea9

                SHA1

                39b34fe438352f7b095e24c89968fca48b8ce11c

                SHA256

                35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

                SHA512

                9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

                Download Submit