Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 15:36
General
-
Target
8_sample.exe
-
Size
29KB
-
MD5
441198e764d65901601e49920caaac31
-
SHA1
4e9362c675097686a0a84147b16567fce402a78d
-
SHA256
4793b892c2efde4b9c0253226c7c3ee3f96e0c30744a0bbde3dbdf4307353944
-
SHA512
1829d3133d25c6fda1c927498b5ae0e2e3524e24959b31502cb2a9e1091d37d53a543f52de549c6daca4281ad08bff071a130f71c8f5166ce83b86b3d895d571
-
SSDEEP
768:d5eDlBEtlGdTRyWHnoyKFSTxxIilCi6LhlGax:d6lB4l83HnTvNCi6LTGax
Score
10/10
Malware Config
Extracted
Family
originbotnet
C2
https://joshua6440.nitrosoftwares.shop/gate
Attributes
-
add_startup
false
-
download_folder_name
jfede1fc.mke
-
hide_file_startup
false
-
startup_directory_name
MnNshND
-
startup_environment_name
appdata
-
startup_installation_name
MnNshND.exe
-
startup_registry_name
MnNshND
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
-
OriginBotnet
OriginBotnet is a remote access trojan written in C#.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8_sample.exe"C:\Users\Admin\AppData\Local\Temp\8_sample.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 17442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2184 -ip 21841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
7.7MB