Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2023, 10:28
Behavioral task
behavioral1
Sample
060798e07011c5b9cb44cebe483b72be.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
060798e07011c5b9cb44cebe483b72be.exe
Resource
win10v2004-20231215-en
General
-
Target
060798e07011c5b9cb44cebe483b72be.exe
-
Size
330KB
-
MD5
060798e07011c5b9cb44cebe483b72be
-
SHA1
31ecf287cebeb549b98cb65d2f3121a73f818e93
-
SHA256
2b163d858eb3d68f778923ba37eba2a18a211b1ada71085e723580adbb61a7cd
-
SHA512
515d51b2ad855d75bc34a753fe5d1ce40c2f38997f68cd58be7ec497156a55b594f33b2b985421a7c6624d6a6e2df67bffdeac6a08429235b1c7cd12294fb3d4
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL3ks3ih1XGWB:v6Wq4aaE6KwyF5L0Y2D1PqLF3c2M
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1384 commander.exe 3672 commander.exe -
resource yara_rule behavioral2/memory/3192-0-0x0000000000400000-0x00000000004B6000-memory.dmp upx behavioral2/memory/3192-8-0x0000000000400000-0x00000000004B6000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3192-8-0x0000000000400000-0x00000000004B6000-memory.dmp autoit_exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\commander.exe 060798e07011c5b9cb44cebe483b72be.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 060798e07011c5b9cb44cebe483b72be.exe File opened for modification C:\Windows\svhost.exe 060798e07011c5b9cb44cebe483b72be.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3192 060798e07011c5b9cb44cebe483b72be.exe 3192 060798e07011c5b9cb44cebe483b72be.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3192 wrote to memory of 1384 3192 060798e07011c5b9cb44cebe483b72be.exe 87 PID 3192 wrote to memory of 1384 3192 060798e07011c5b9cb44cebe483b72be.exe 87 PID 3192 wrote to memory of 1384 3192 060798e07011c5b9cb44cebe483b72be.exe 87 PID 1384 wrote to memory of 2808 1384 commander.exe 89 PID 1384 wrote to memory of 2808 1384 commander.exe 89 PID 1384 wrote to memory of 2808 1384 commander.exe 89 PID 3192 wrote to memory of 3672 3192 060798e07011c5b9cb44cebe483b72be.exe 91 PID 3192 wrote to memory of 3672 3192 060798e07011c5b9cb44cebe483b72be.exe 91 PID 3192 wrote to memory of 3672 3192 060798e07011c5b9cb44cebe483b72be.exe 91 PID 3672 wrote to memory of 4708 3672 commander.exe 93 PID 3672 wrote to memory of 4708 3672 commander.exe 93 PID 3672 wrote to memory of 4708 3672 commander.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\060798e07011c5b9cb44cebe483b72be.exe"C:\Users\Admin\AppData\Local\Temp\060798e07011c5b9cb44cebe483b72be.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\commander.execommander.exe /C at 9:00 /interactive C:\Windows\svhost.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\at.exeat 9:00 /interactive C:\Windows\svhost.exe3⤵PID:2808
-
-
-
C:\Windows\SysWOW64\commander.execommander.exe /C schtasks /run /tn at12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /tn at13⤵PID:4708
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5931a7e7ffd8a72755f58864c9fe2c278
SHA1eb9884506d72a08687662123e1fe05677d5c2388
SHA2568455c6f5910646dac2820a5b78dfd05a8b3177d00fc916f73b0b8f908ad2d210
SHA512a3bc7d7c3bf26752c859da0539e09182340c4be8e6071d5e800f5686f958b53d7868c6eeeba740a6bf2ed5bd64e9c222967beaab857fec81be7b62e5408a3849