Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13/05/2024, 18:44
General
-
Target
12.exe
-
Size
45KB
-
MD5
e495926b851b044d702e8ca3792e8997
-
SHA1
8998457297aa42ca53ff2c5118b3721b184108ec
-
SHA256
c79572263f72b42dc7e7fef376c32b3cc33cf5f543373e7896d5e81cef0911ff
-
SHA512
09bb2a11f639dd1ecb51c71117d6fbad736e70a6ce92e1316cf92a6a8288dc0ef1364d14cbb050fdb39725f3154d5dc425392249c43476eec1d06879942c815a
-
SSDEEP
768:BdhO/poiiUcjlJInwr6BH9Xqk5nWEZ5SbTDaUuI7CPW5Q:/w+jjgndH9XqcnW85SbThuI4
Malware Config
Extracted
xenorat
7.tcp.eu.ngrok.io
radnom123_34X41
-
delay
5000
-
install_path
appdata
-
port
19280
-
startup_name
window system
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4872 12.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 1 7.tcp.eu.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2104 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe 4872 12.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4872 12.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4664 wrote to memory of 4872 4664 12.exe 73 PID 4664 wrote to memory of 4872 4664 12.exe 73 PID 4664 wrote to memory of 4872 4664 12.exe 73 PID 4872 wrote to memory of 2104 4872 12.exe 74 PID 4872 wrote to memory of 2104 4872 12.exe 74 PID 4872 wrote to memory of 2104 4872 12.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\12.exe"C:\Users\Admin\AppData\Local\Temp\12.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Roaming\XenoManager\12.exe"C:\Users\Admin\AppData\Roaming\XenoManager\12.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "window system" /XML "C:\Users\Admin\AppData\Local\Temp\tmp71F4.tmp" /F3⤵
- Creates scheduled task(s)
PID:2104
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5957779c42144282d8cd83192b8fbc7cf
SHA1de83d08d2cca06b9ff3d1ef239d6b60b705d25fe
SHA2560d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51
SHA512f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd
-
Filesize
1KB
MD5bad6890e2faac7e06d93f5020ce4ba18
SHA10b47d1629d1ec0dcda62f7fabf4485b7625e4bf9
SHA256a6be7e1850527f0bf2629be8850563fc8cd2b1cd1b51805663fc6cd8ec5f5ba4
SHA5125707f632396da4bb9282f49145c19479fcfce24aed6657d3bf12109b0785757f68d31055091a48ab82ea08ea8692a3899be6cb2f10101dc6d384634e12ca6665
-
Filesize
45KB
MD5e495926b851b044d702e8ca3792e8997
SHA18998457297aa42ca53ff2c5118b3721b184108ec
SHA256c79572263f72b42dc7e7fef376c32b3cc33cf5f543373e7896d5e81cef0911ff
SHA51209bb2a11f639dd1ecb51c71117d6fbad736e70a6ce92e1316cf92a6a8288dc0ef1364d14cbb050fdb39725f3154d5dc425392249c43476eec1d06879942c815a