Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

D34TH 3.0.bat

windows11-21h2-x64

Analysis

  • max time kernel
    40s
  • max time network
    46s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2024, 15:37

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-20T15:38:42Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win11-20240412-en/instance_8-dirty.qcow2\"}"
Report Analysis Logs

General

  • Target

    D34TH 3.0.bat

  • Size

    1KB

  • MD5

    0f4eb5ba6b7652249cd6f8925cab247f

  • SHA1

    6c5174b3f1b62def3d9ca4da34332a812a6a9db4

  • SHA256

    298d0085347d70e634a5d8d8487d067666ef8bf25808e7605d860187502f016a

  • SHA512

    6b97c3d147a540fc4ab92dcf0bbce8fdaf75dc2ff4680b63ef17a338a8b1e36676b5f3a1fe46a8e8f453bf915fa1ae064aef703ab3b13fe1c45adfa958484788

Score
8/10
discoveryevasion

Malware Config

Signatures

  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Modifies Windows Firewall 2 TTPs 7 IoCs
    evasion
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\D34TH 3.0.bat"
    1⤵
    • Drops file in Drivers directory
    • Manipulates Digital Signatures
    • Drops file in System32 directory
    • Modifies termsrv.dll
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Windows\system32\nslookup.exe
      nslookup myip.opendns.com resolver1.opendns.com
      2⤵
        PID:4976
      • C:\Windows\system32\netsh.exe
        netsh wlan show profiles
        2⤵
          PID:3240
        • C:\Windows\system32\ipconfig.exe
          ipconfig
          2⤵
          • Gathers network information
          PID:4204
        • C:\Windows\system32\ipconfig.exe
          ipconfig
          2⤵
          • Gathers network information
          PID:660
        • C:\Windows\system32\find.exe
          find /i "IPv4"
          2⤵
            PID:2964
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic diskdrive get size
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4784
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic cpu get name
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3340
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            2⤵
            • Gathers system information
            PID:3348
          • C:\Windows\system32\netsh.exe
            netsh firewall set opmode disable
            2⤵
            • Modifies Windows Firewall
            PID:224
          • C:\Windows\system32\netsh.exe
            netsh firewall set opmode mode=DISABLE
            2⤵
            • Modifies Windows Firewall
            PID:3092
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set currentprofile state off
            2⤵
            • Modifies Windows Firewall
            PID:4556
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set domainprofile state off
            2⤵
            • Modifies Windows Firewall
            PID:3484
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set privateprofile state off
            2⤵
            • Modifies Windows Firewall
            PID:4028
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set publicprofile state off
            2⤵
            • Modifies Windows Firewall
            PID:1776
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set allprofiles state off
            2⤵
            • Modifies Windows Firewall
            PID:2724
          • C:\Windows\system32\takeown.exe
            takeown /f C:\Windows\System32
            2⤵
            • Modifies file permissions
            PID:4528
          • C:\Windows\system32\takeown.exe
            takeown /f C:\Windows\System
            2⤵
            • Modifies file permissions
            PID:416
          • C:\Windows\system32\takeown.exe
            takeown /f C:\Windows\Boot
            2⤵
            • Modifies file permissions
            PID:5024
          • C:\Windows\system32\takeown.exe
            takeown /f C:\Windows\Fonts
            2⤵
            • Modifies file permissions
            PID:4700
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im svchost.exe
            2⤵
            • Kills process with taskkill
            PID:1604
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1668

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads