Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2023, 17:04
Behavioral task
behavioral1
Sample
1phc1YJN.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
1phc1YJN.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
1phc1YJN.exe
-
Size
37KB
-
MD5
fb0bdd758f8a9f405e6af2358da06ae1
-
SHA1
6c283ab5e49e6fe3a93a996f850a5639fc49e3f5
-
SHA256
9da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
-
SHA512
71d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253
-
SSDEEP
384:NOpYoixJbl7OHg1WykrDPf7O8GsnRlrAF+rMRTyN/0L+EcoinblneHQM3epzXNsG:gpeR1NkrDPSlsRlrM+rMRa8NuPsCt
Malware Config
Extracted
njrat
im523
TrupAshot
documents-elegant.at.ply.gg:54835
4a87b5397a2736773782f50e108b2da4
-
reg_key
4a87b5397a2736773782f50e108b2da4
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1808 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 1phc1YJN.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4a87b5397a2736773782f50e108b2da4.exe conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4a87b5397a2736773782f50e108b2da4.exe conhost.exe -
Executes dropped EXE 1 IoCs
pid Process 4656 conhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4a87b5397a2736773782f50e108b2da4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .." conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4a87b5397a2736773782f50e108b2da4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe\" .." conhost.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf conhost.exe File created D:\autorun.inf conhost.exe File created C:\autorun.inf conhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe 4656 conhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4656 conhost.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe Token: 33 4656 conhost.exe Token: SeIncBasePriorityPrivilege 4656 conhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4400 wrote to memory of 4656 4400 1phc1YJN.exe 87 PID 4400 wrote to memory of 4656 4400 1phc1YJN.exe 87 PID 4400 wrote to memory of 4656 4400 1phc1YJN.exe 87 PID 4656 wrote to memory of 1808 4656 conhost.exe 91 PID 4656 wrote to memory of 1808 4656 conhost.exe 91 PID 4656 wrote to memory of 1808 4656 conhost.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1phc1YJN.exe"C:\Users\Admin\AppData\Local\Temp\1phc1YJN.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Roaming\conhost.exe"C:\Users\Admin\AppData\Roaming\conhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\conhost.exe" "conhost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1808
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5fb0bdd758f8a9f405e6af2358da06ae1
SHA16c283ab5e49e6fe3a93a996f850a5639fc49e3f5
SHA2569da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
SHA51271d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253
-
Filesize
37KB
MD5fb0bdd758f8a9f405e6af2358da06ae1
SHA16c283ab5e49e6fe3a93a996f850a5639fc49e3f5
SHA2569da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
SHA51271d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253
-
Filesize
37KB
MD5fb0bdd758f8a9f405e6af2358da06ae1
SHA16c283ab5e49e6fe3a93a996f850a5639fc49e3f5
SHA2569da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
SHA51271d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253