Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 18:19

General

  • Target

    Document_g55_79a057639-91h49176a6220-1759n0.js

  • Size

    533KB

  • MD5

    9b86cd448940a50ab43472676dacb5c0

  • SHA1

    1798cb554fb40bfe6dce86759987e1a3b489f73a

  • SHA256

    bb9203ca1305e47a2ec1443a640efcd5e2c7d11223184639729673579e12967e

  • SHA512

    c3861177009fb9d20fe9b95d6e779ac3ede9a599b8a82a1e0df45d2525e22ee1d80111807223a3572b701dd4caa9d680e9dae9419fa7925fcd85bc59ba9e0ddf

  • SSDEEP

    6144:VTgoYSJ9u2EKHnzirPK86zjXKnjXMjHtIfC3YsS61l3wioIfOEu6TcX3soAEiO8u:xgUJsriGrK8ODNp33ZdBfG3mEsmd

Score
10/10

Malware Config

Extracted

Family

latrodectus

C2

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Detect larodectus Loader variant 2 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Document_g55_79a057639-91h49176a6220-1759n0.js
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2312
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4097BA875D242428B3136422C014525A
      2⤵
      • Loads dropped DLL
      PID:4728
    • C:\Windows\Installer\MSI3ED4.tmp
      "C:\Windows\Installer\MSI3ED4.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\glosar\beta.dll, homq
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:932
  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\glosar\beta.dll, homq
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\System32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_c34cd7.dll", homq
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3444

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e573e34.rbs

    Filesize

    1KB

    MD5

    04cf254e38d376457356d012ad61e574

    SHA1

    d04e74f5cebf3f01078b197fd4d421e9c89ed2ba

    SHA256

    fc190fa0041e7a7623d1cd8fd7167d553094f65903580e1e2890a73e009e0f1e

    SHA512

    24f30e6edecf723f8df7d85a1e2e165243a314a4081eeec60ff59c73b50dfb30819f9718433179441d73b68999789a9416b7b8b15bfd07f0dc053e98c6767e58

  • C:\Users\Admin\AppData\Local\glosar\beta.dll

    Filesize

    364KB

    MD5

    a1c84c14a82f2cbb7e9a5f253d721159

    SHA1

    3aa5e70111c290c45daac06984281dfb5439115b

    SHA256

    53e65d071870f127bc6bf6c8e8ddfd131558153513976744ee7460eeb766d081

    SHA512

    f76691853fa45d93246dfd8569af5ec7e66fdd7536241b92ee10bb9202b0502e66dfd030fe539956fb28fe20e71b33cae524038c356facf555d4a130c64665ed

  • C:\Windows\Installer\MSI396F.tmp

    Filesize

    1.3MB

    MD5

    f83ed040b4e52088817df73ef51fe0d3

    SHA1

    3d011c54ae9a66ef2a865afd694712b338feed5d

    SHA256

    a9fa025fe912c8ad5e6566c675e045732c4d89f4187bfd94c4e916dd9fe25417

    SHA512

    c4fe6171f4590a3f588bba5818d05ed525619fc3333f911ea785bebea11788f144b71974254f6dbf270a2b89f9c21698d882d378274cf63005223fe5618d15f0

  • C:\Windows\Installer\MSI3CDB.tmp

    Filesize

    436KB

    MD5

    475d20c0ea477a35660e3f67ecf0a1df

    SHA1

    67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

    SHA256

    426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

    SHA512

    99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

  • C:\Windows\Installer\MSI3ED4.tmp

    Filesize

    389KB

    MD5

    b9545ed17695a32face8c3408a6a3553

    SHA1

    f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

    SHA256

    1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

    SHA512

    f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

  • memory/2640-43-0x0000000180000000-0x0000000180066000-memory.dmp

    Filesize

    408KB

  • memory/3444-57-0x00000234A0020000-0x00000234A0034000-memory.dmp

    Filesize

    80KB