Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
268s -
max time network
270s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20/02/2024, 01:29
General
-
Target
MRT.exe
-
Size
182.3MB
-
MD5
acfdc6a3a039cfb1462c3b81cbe6a2a5
-
SHA1
5bad1bc03464264685c85f1837dbf5a94f2de967
-
SHA256
25dda001be45839c985f0db2a1b60a3399aa2ad4079c15fa429ebd08f9e0a7bd
-
SHA512
62cc138abac9b611348c380d379bbbf37bb8c2b8dd0ca12537d05668fbb24fce046793918203180a153aba4af336db4569f85b222d9e71d6bc275b0506e4e5ca
-
SSDEEP
3145728:ExZI1yI6xMfOpPRmbkoeuPBxTBNkDHhI3OQL2PZ8tG63ZBSLtwgfYyE2/6/w/95A:YZI1WpJmreSBbYwRsJon
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Registers COM server for autorun 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MRT.exe"C:\Users\Admin\AppData\Local\Temp\MRT.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.1MB
MD528a2fa550a086488708a76033fa93595
SHA1dcde5ed21ba5db2404406026ce224e5370a3f281
SHA256b6b50c1f0a062887945ffa8f99278739bc3c25e1999a4e2dfa228bc3ecb1f43c
SHA512645f3a60a2c665c11878ee1718c2cd941ad8545247af57fa33bb6331e2552fc59244dbf581ff44355d24eec089d11f82ebaa74c29d69f889d73d11d1f0c73522
-
Filesize
12.4MB
MD5691cee60da58c396c1fd24176d2477a3
SHA13db4cdbc5a75e568e68f8938f9eef38c2f394c8c
SHA256bf6e1b00e5a38d5316a0705c20485970c0e1d958a0e941a7ef6c229545bd3b65
SHA512312a0f30f48d2b6f49e04fadcefd7efe4c7ef60df94b05c1cb02f19d847fca89c5f564088c1a967dda6465ccb23c79f5a6d7a77b4369637500f357dafdc52c8c
-
Filesize
607KB
MD5a0c4ac6378ce0313955dccfd2d9208a6
SHA17ee2f0f3bf4504f4f7bbc63cb5fa883711c13801
SHA256abbe3285c58c830314f9f0ad2ddc769139c0d808e27893290adc69a535b996b1
SHA51272ea9f0d7399fa5d6865f3f887ffa07098b883b1428b33dcb552a40bb22ca6a461a546736667ca1aa97e5f06dffd10dab765c7f6e3e827dd0335b562b27d2fb5
-
Filesize
5.1MB
-
Filesize
3.5MB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
300KB
-
Filesize
292KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1.1MB
-
Filesize
2.0MB
-
Filesize
1024KB
-
Filesize
1.1MB
-
Filesize
2.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1.1MB
-
Filesize
128KB
-
Filesize
1.1MB
-
Filesize
128KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
128KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB