Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
merrinati.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
merrinati.exe
Resource
win10v2004-20230915-en
General
-
Target
merrinati.exe
-
Size
1.3MB
-
MD5
45704959e2d309ca096e3104e770313d
-
SHA1
00bad92e5857b6fe5b0ee3abe90da5e47407bcd2
-
SHA256
fdd6f27c9cb4dae48f6ca4290543780ccf7dd9a7999545c1086e933c240b622e
-
SHA512
8e362fa23703714cc5a450434fc9dfdc36a24bc3da56708053e911e5e4de3f73c250b4ddcec833af88a083bd87c05d697c15309cb2851106fd25b98e57424d83
-
SSDEEP
24576:MZhoiQ9lUi6S4mdU8dyQnX82ZT8M9ETQh/7aHMnKIg06u:Tv9lUi6dmd9nLYM1h/7aqKxu
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation 1a557.exe -
Executes dropped EXE 3 IoCs
pid Process 1432 1a557.exe 1268 WindowsInput.exe 640 AudioDriver64.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsInput.exe 1a557.exe File opened for modification C:\Windows\SysWOW64\WindowsInput.InstallLog WindowsInput.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe 640 AudioDriver64.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 640 AudioDriver64.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 640 AudioDriver64.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1432 2532 merrinati.exe 82 PID 2532 wrote to memory of 1432 2532 merrinati.exe 82 PID 2532 wrote to memory of 1432 2532 merrinati.exe 82 PID 1432 wrote to memory of 1268 1432 1a557.exe 86 PID 1432 wrote to memory of 1268 1432 1a557.exe 86 PID 1432 wrote to memory of 640 1432 1a557.exe 91 PID 1432 wrote to memory of 640 1432 1a557.exe 91 PID 1432 wrote to memory of 640 1432 1a557.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\merrinati.exe"C:\Users\Admin\AppData\Local\Temp\merrinati.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\1a557.exeC:\Users\Admin\AppData\Local\Temp\1a557.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1268
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver64.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
842KB
MD5ba349b4bf0dc890f8d96b53b54c2942a
SHA1a934352c046ec81d0a7d8673b751955cf9c7958a
SHA25676330537394ecbe2feb0b85b11975454d03735d6737960a1a810315a8afe0c49
SHA5120a65412a43509339b112c2db699f82d4e1de82b48aa1ac2669227877e453c1541f9dd82816ef07b329f2132a6029af54341d8755db8a83cb1d55442e12d10b94
-
Filesize
842KB
MD5ba349b4bf0dc890f8d96b53b54c2942a
SHA1a934352c046ec81d0a7d8673b751955cf9c7958a
SHA25676330537394ecbe2feb0b85b11975454d03735d6737960a1a810315a8afe0c49
SHA5120a65412a43509339b112c2db699f82d4e1de82b48aa1ac2669227877e453c1541f9dd82816ef07b329f2132a6029af54341d8755db8a83cb1d55442e12d10b94
-
Filesize
842KB
MD5ba349b4bf0dc890f8d96b53b54c2942a
SHA1a934352c046ec81d0a7d8673b751955cf9c7958a
SHA25676330537394ecbe2feb0b85b11975454d03735d6737960a1a810315a8afe0c49
SHA5120a65412a43509339b112c2db699f82d4e1de82b48aa1ac2669227877e453c1541f9dd82816ef07b329f2132a6029af54341d8755db8a83cb1d55442e12d10b94
-
Filesize
842KB
MD5ba349b4bf0dc890f8d96b53b54c2942a
SHA1a934352c046ec81d0a7d8673b751955cf9c7958a
SHA25676330537394ecbe2feb0b85b11975454d03735d6737960a1a810315a8afe0c49
SHA5120a65412a43509339b112c2db699f82d4e1de82b48aa1ac2669227877e453c1541f9dd82816ef07b329f2132a6029af54341d8755db8a83cb1d55442e12d10b94
-
Filesize
842KB
MD5ba349b4bf0dc890f8d96b53b54c2942a
SHA1a934352c046ec81d0a7d8673b751955cf9c7958a
SHA25676330537394ecbe2feb0b85b11975454d03735d6737960a1a810315a8afe0c49
SHA5120a65412a43509339b112c2db699f82d4e1de82b48aa1ac2669227877e453c1541f9dd82816ef07b329f2132a6029af54341d8755db8a83cb1d55442e12d10b94
-
Filesize
597B
MD5c2291863df7c2d3038ce3c22fa276506
SHA17b7d2bc07a6c35523807342c747c9b6a19f3184e
SHA25614504199bede3f46129969dbd2b7680f2e5b7fcd73a3e427ce1bb6217a6d13da
SHA51200bf40174a67e3e663d18a887c5b461a1e5ead0b27f0a139d87969158c58f4ca72cfa5a731dda239356192ca4cb5ac6ae2b0e37401d534e686cabacd3cbee8fa
-
Filesize
21KB
MD5e854a4636afc652b320e12e50ba4080e
SHA18a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc
SHA25694b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5
SHA51230aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118
-
Filesize
21KB
MD5e854a4636afc652b320e12e50ba4080e
SHA18a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc
SHA25694b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5
SHA51230aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118
-
Filesize
21KB
MD5e854a4636afc652b320e12e50ba4080e
SHA18a4ac6ecc22ee5f3a8ec846d38b41ff18c641fdc
SHA25694b9c78c6fa2bf61fba20a08ad4563f7dd2f5668c28eff227965ce0a2032d5d5
SHA51230aabd5079b6ed0948eb70fd18e9166096e4ba5d1d47fc35b7270f931d19bbe6cd929b6010f70297bf5272dc5a79e2523721354d211c4080d68ad8d17e316118