Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 14:54

General

  • Target

    a411fc6843115ea92a124822e65dadfd.exe

  • Size

    24KB

  • MD5

    a411fc6843115ea92a124822e65dadfd

  • SHA1

    cd861b6d288346fa8e93ef5f4da9a655f4fc27d2

  • SHA256

    6dc7e4d80501dd49c151e22cdb697e597ac9d2e8f2ee71e083bb5c5e5b7e60c4

  • SHA512

    2dc5432eb05963e806ac655077381f6486ae50b174a82a5c87bcb75c443de8bdde8b7f121e594c6d61d3eb524b46fa47569b0b13758dcd9f7254017d2e28dd76

  • SSDEEP

    384:E3eVES+/xwGkRKJq06VlM61qmTTMVF9/q5j0:bGS+ZfbJq06VO8qYoAI

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a411fc6843115ea92a124822e65dadfd.exe
    "C:\Users\Admin\AppData\Local\Temp\a411fc6843115ea92a124822e65dadfd.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:2876
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:4056
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4800
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:364
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            4⤵
              PID:4892
          • C:\Windows\SysWOW64\NETSTAT.EXE
            netstat -an
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:5040

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        14KB

        MD5

        47166cc128c3aa5384c6ebedf6b3e575

        SHA1

        0d8cf16ade8464eac3f9a5edf5c49aacb7005042

        SHA256

        ac29daa7963b494f90839aa6d3723e789992ee9ec505d980da8de97406ea6c1c

        SHA512

        27c7f1e35228d0a573abbe17a12849ae430f871dacbcc0d39a545d0fccc9a62ef88d9639158804369b5356b1a0520992a639546876d0d550eeb7bb9c798904a6