Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 21:39
Static task
static1
Errors
General
-
Target
Anarchy Loader.exe
-
Size
54.7MB
-
MD5
5016491d1b400d431bf64bdfaa2402f2
-
SHA1
87c7f677cdbebefdedc3d7d975c2bb4f7725412a
-
SHA256
98b14faa7577d52999942de580275ecd78ef3f1e236ab52f646ceb562fce07ad
-
SHA512
cad0fd505e07b81540408a71e311e2e23f305a7508859d411a7b1d8d1a90547c264da4cf25c39fb0a1f33070f51bfafb42265be64affe9c4f07e61c4411d98d6
-
SSDEEP
1572864:r7s7RAkmum9Dio4y92UGp1DUMSoZ4XisCTK+OhiO0iQOCL:rI79hm9D54yAUs1DUBh3CTjOqiQO
Malware Config
Extracted
xworm
209.25.141.181:31533
-
Install_directory
%Temp%
-
install_file
INCCHECK.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral1/files/0x000c0000000006c5-6.dat family_xworm behavioral1/memory/3952-13-0x0000000000F30000-0x0000000000F4E000-memory.dmp family_xworm -
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/1388-25-0x0000000000CD0000-0x000000000436E000-memory.dmp family_zgrat_v1 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/1388-25-0x0000000000CD0000-0x000000000436E000-memory.dmp net_reactor -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation Anarchy Loader.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INCCHECK.lnk AnarchyInstall.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INCCHECK.lnk AnarchyInstall.exe -
Executes dropped EXE 2 IoCs
pid Process 3952 AnarchyInstall.exe 1388 Anarchy Panel.exe -
Loads dropped DLL 1 IoCs
pid Process 1388 Anarchy Panel.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\INCCHECK = "C:\\Users\\Admin\\AppData\\Local\\Temp\\INCCHECK.exe" AnarchyInstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3224 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3952 AnarchyInstall.exe Token: SeDebugPrivilege 1388 Anarchy Panel.exe Token: SeDebugPrivilege 3952 AnarchyInstall.exe Token: SeDebugPrivilege 4760 taskmgr.exe Token: SeSystemProfilePrivilege 4760 taskmgr.exe Token: SeCreateGlobalPrivilege 4760 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe 4760 taskmgr.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2000 wrote to memory of 3952 2000 Anarchy Loader.exe 86 PID 2000 wrote to memory of 3952 2000 Anarchy Loader.exe 86 PID 2000 wrote to memory of 1388 2000 Anarchy Loader.exe 87 PID 2000 wrote to memory of 1388 2000 Anarchy Loader.exe 87 PID 1388 wrote to memory of 2328 1388 Anarchy Panel.exe 96 PID 1388 wrote to memory of 2328 1388 Anarchy Panel.exe 96 PID 2328 wrote to memory of 3124 2328 cmd.exe 98 PID 2328 wrote to memory of 3124 2328 cmd.exe 98 PID 3124 wrote to memory of 3224 3124 cmd.exe 100 PID 3124 wrote to memory of 3224 3124 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Anarchy Loader.exe"C:\Users\Admin\AppData\Local\Temp\Anarchy Loader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\AnarchyInstall.exe"C:\Users\Admin\AppData\Local\Temp\AnarchyInstall.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"C:\Users\Admin\AppData\Local\Temp\Anarchy Panel.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c start cmd /C "color b && title Error && echo SSL assertion fail, make sure you're not debugging Network. Disable internet firewall on router if possible. & echo: & echo If not, ask the developer of the program to use custom domains to fix this. && timeout /t 5"3⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo SSL assertion fail, make sure you're not debugging Network. Disable internet firewall on router if possible. & echo: & echo If not, ask the developer of the program to use custom domains to fix this. && timeout /t 5"4⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\system32\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
PID:3224
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD557fdae25873ed915da75aa33c9eb6d66
SHA15f835c20c97fc83b976fbea8345b01d96e5f1546
SHA256c9074dc3e9e6e06260f4e40980ef2fbfd8b50cf449e20f250d277cadbd7909c0
SHA5121191005e24a64b215ea866c8472411e13b22908ae98d42c758bb317bd6182cd671321d7c501db4d779e2234106d7cf8a118eea9f9dd698f578dc25b0098088f6
-
Filesize
1.7MB
MD556a504a34d2cfbfc7eaa2b68e34af8ad
SHA1426b48b0f3b691e3bb29f465aed9b936f29fc8cc
SHA2569309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
SHA512170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
-
Filesize
1KB
MD528afff47843548caeff46759cad72eda
SHA1d908d91bc7733f132ca9d3df7748f77d8a7641a1
SHA25657f07f7e3511d92eb9d763d10219ed5d9b3601457d01aaaf708b8f1baf8b96dc
SHA512c5b6492bc6a304116f05ff12e9b0dd6a9accb35920f6dd76c1e2d70070572aaeb81da743a984548dc8e6615fa8ccbdc356a57c3ce9df8158b3aebc9814d23728