Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 23:07

General

  • Target

    1f734d29cf2993ec66e579ca90cb003c.exe

  • Size

    24KB

  • MD5

    1f734d29cf2993ec66e579ca90cb003c

  • SHA1

    d3cd997815e53b646e72a71889ef757220e318f5

  • SHA256

    10c40ca72f76a46fe1854c35d663fe86fe3b8b835f8689362cc269d6305a1a2f

  • SHA512

    fdae6b463c8156039ff1d8b3f364757c1375537e6d37582fc26e261c69147a219ac5a18711c3bb997bf377847b874363543e439af7d77f49c9a6544c6b3c2b49

  • SSDEEP

    384:E3eVES+/xwGkRKJVPlM61qmTTMVF9/q5Z0:bGS+ZfbJVPO8qYoAm

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f734d29cf2993ec66e579ca90cb003c.exe
    "C:\Users\Admin\AppData\Local\Temp\1f734d29cf2993ec66e579ca90cb003c.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4584
  • C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    1⤵
      PID:920
    • C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      1⤵
      • Gathers network information
      PID:5076
    • C:\Windows\SysWOW64\tasklist.exe
      tasklist
      1⤵
      • Enumerates processes with tasklist
      • Suspicious use of AdjustPrivilegeToken
      PID:1464
    • C:\Windows\SysWOW64\net.exe
      net start
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 start
        2⤵
          PID:3500
      • C:\Windows\SysWOW64\NETSTAT.EXE
        netstat -an
        1⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:4936

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        14KB

        MD5

        c27ee32fc9095278fee335a5b331d6d0

        SHA1

        130b5a6bb611a8243af84df0de6612395963ba3b

        SHA256

        ac40d58791f8d8d6bb4c3c2ea12387a183aa7add155194a78f785f58b7d2fe51

        SHA512

        958a811c6260903b1d1af4e06f64eadac2753c73e2a7da418f5505037ed0ea229104c889102f546543f9601fe61c312dea6b2ba63449608608aa19a87d3a71ff