Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

dont run.exe

windows10-1703-x64

4

Resubmissions

22/04/2023, 00:12

230422-ahh76aba63 4

22/04/2023, 00:06

230422-ad5klaba37 1

22/04/2023, 00:00

230422-aafgasch3w 1

Analysis

  • max time kernel
    17s
  • max time network
    19s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/04/2023, 00:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dont run.exe

  • Size

    14.3MB

  • MD5

    6fd1a07f5f710341d9e1d4e18b68cdaf

  • SHA1

    43c0d8cac5e2b83af79aadea42d7202fa78ddd9b

  • SHA256

    0ecb876346cbf85ff36f4983bed844f1939c395e6453b6cfed28faa3e796d345

  • SHA512

    d1b8fc83eb09fd14df78bf3463659f3b29e956acaa70eb54c2ac6d5698467e411e51af0c79cc793193b3d40cec9893b9163fe10de1e5bfa4a42b603a5c5f5006

  • SSDEEP

    393216:lvPJzIS+3WFGw+cBZWOpq9bwJsv6tWKFdu9Ceuqa:lHJL+3WF/+c4uqa

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dont run.exe
    "C:\Users\Admin\AppData\Local\Temp\dont run.exe"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2284
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0xf8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2592
  • C:\Windows\System32\SystemSettingsBroker.exe
    C:\Windows\System32\SystemSettingsBroker.exe -Embedding
    1⤵
      PID:320
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
      1⤵
        PID:4688
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservice -s SstpSvc
        1⤵
          PID:4696
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:3776
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
          1⤵
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s RasMan
          1⤵
            PID:1344

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\INF\netrasa.PNF
            Filesize

            22KB

            MD5

            80648b43d233468718d717d10187b68d

            SHA1

            a1736e8f0e408ce705722ce097d1adb24ebffc45

            SHA256

            8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

            SHA512

            eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

            Download Submit

          • C:\Windows\INF\netsstpa.PNF
            Filesize

            6KB

            MD5

            01e21456e8000bab92907eec3b3aeea9

            SHA1

            39b34fe438352f7b095e24c89968fca48b8ce11c

            SHA256

            35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

            SHA512

            9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

            Download Submit