Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 00:07

General

  • Target

    a0b352c83af0acd62f6f869e689c4ea7.exe

  • Size

    24KB

  • MD5

    a0b352c83af0acd62f6f869e689c4ea7

  • SHA1

    e2a5645f2e368332bf129c1a7c3372feef65ff5b

  • SHA256

    906e2b6f50b5b228174f20b45e614b80606589de602c1e2b49e0311ed73396c9

  • SHA512

    c5ec97e3396d4b9fed2ce6b55a7ceae3dd50bc2bc492efcc2d780187d6e323a852ada0de75b465368447b3c8c14031a412cc91512a9abe3a76a8eb091f8a386b

  • SSDEEP

    384:E3eVES+/xwGkRKJ3cZlM61qmTTMVF9/q5e80:bGS+ZfbJMZO8qYoAet

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe
    "C:\Users\Admin\AppData\Local\Temp\a0b352c83af0acd62f6f869e689c4ea7.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:4944
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:4568
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2008
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4656
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            4⤵
              PID:4380
          • C:\Windows\SysWOW64\NETSTAT.EXE
            netstat -an
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:3480

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        14KB

        MD5

        b7f87aab159abb5a36a5d6f8f5bea1a8

        SHA1

        ae71f2e770a974e931c1de6d9a6512c63658a8d5

        SHA256

        cdf6b79f5553366a863f0f4e830cffbab6bd2aa5aed199185216d69a0406c22c

        SHA512

        08f9c7b09fcb43fbbd40a70e7413f633fc4076117e23e7e511d698f19302e739534be9007cf8c0026f7a03a2b63483a211b6fa37100e371f3a6bf608f063d12a