Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/05/2024, 17:55

240516-whltyagg49 8

16/05/2024, 17:41

240516-v9rc3aga5w 8

16/05/2024, 17:28

240516-v2byeafg62 8

Analysis

  • max time kernel
    1797s
  • max time network
    1801s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 17:41

General

  • Target

    Okthabah.exe

  • Size

    434KB

  • MD5

    66affb0ca8f6d6370cc61db763a1031f

  • SHA1

    b1bb40419c56cb0418d7657f4fb9cfefca902d44

  • SHA256

    68ac1c517be7a28e59ed717f6e2ed7b94f81ae595ded1454f38c928fbaad6b71

  • SHA512

    b305a5de0b8c91d0a3f376ed71ca8f456cab74f993bf73c2cccee452a3ff54e7c50eaac13efc003ff8c531f35fb12f45334003ab1caffb95f137ff85800bce80

  • SSDEEP

    12288:IR3eJ+U4Q9O1cj/jIkfLKi/0B9eK59c+4uzCf9uJWRU:o3eJ+Ung8/jIkf2taK59c+hO+EU

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Okthabah.exe
    "C:\Users\Admin\AppData\Local\Temp\Okthabah.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Gurgoyle111=Get-Content 'C:\Users\Admin\AppData\Local\dialaktologer\Onerosity240.Ops';$Septentrionally=$Gurgoyle111.SubString(51382,3);.$Septentrionally($Gurgoyle111)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
        3⤵
          PID:2644
        • C:\Users\Admin\AppData\Local\Temp\Multipotent.exe
          "C:\Users\Admin\AppData\Local\Temp\Multipotent.exe"
          3⤵
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hemostasis" /t REG_EXPAND_SZ /d "%Refrygtigest25% -windowstyle minimized $Matineerne84=(Get-ItemProperty -Path 'HKCU:\Udskrivningsmenuers\').Irakerne;%Refrygtigest25% ($Matineerne84)"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1684
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hemostasis" /t REG_EXPAND_SZ /d "%Refrygtigest25% -windowstyle minimized $Matineerne84=(Get-ItemProperty -Path 'HKCU:\Udskrivningsmenuers\').Irakerne;%Refrygtigest25% ($Matineerne84)"
              5⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:2824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\dialaktologer\Modsige.Til247

      Filesize

      293KB

      MD5

      880027bdc9ba2cbde2c9259068d86358

      SHA1

      8ffcc2dbf7122a9721c8332c719cee33eb89212e

      SHA256

      0811eb3eca416883f064c8ab6f8d25cfd5fe9f16a27a41e0b4e734a80f044cf5

      SHA512

      2865c12d757fbc6a51e88f095c047780547391c53e1aa7f1b99592b67919c1f41fb0bdb18a185870e039e5861383648dbdb32377c97e0c3394e58d92bbe46d9f

    • C:\Users\Admin\AppData\Local\dialaktologer\Onerosity240.Ops

      Filesize

      50KB

      MD5

      6b4519b036b5b1961ff12ebb9bf92152

      SHA1

      d576508e86ec7e3c53bfbe8a68ee99b4e71fcc96

      SHA256

      45b0d4e32da65cc44236f47f60d3d86704890afc7eb8ef3770107525c428b976

      SHA512

      bb459f7cbe9d0498c4aaf8c8af0165c85bdecd99e218a37bf33e97fc30ba877d4d80db000cf34c8fce5e9ba29ff97b5a948adaae077f73cb5ed38b88ecb7440a

    • \Users\Admin\AppData\Local\Temp\Multipotent.exe

      Filesize

      434KB

      MD5

      66affb0ca8f6d6370cc61db763a1031f

      SHA1

      b1bb40419c56cb0418d7657f4fb9cfefca902d44

      SHA256

      68ac1c517be7a28e59ed717f6e2ed7b94f81ae595ded1454f38c928fbaad6b71

      SHA512

      b305a5de0b8c91d0a3f376ed71ca8f456cab74f993bf73c2cccee452a3ff54e7c50eaac13efc003ff8c531f35fb12f45334003ab1caffb95f137ff85800bce80

    • memory/2340-8-0x0000000073B61000-0x0000000073B62000-memory.dmp

      Filesize

      4KB

    • memory/2340-9-0x0000000073B60000-0x000000007410B000-memory.dmp

      Filesize

      5.7MB

    • memory/2340-10-0x0000000073B60000-0x000000007410B000-memory.dmp

      Filesize

      5.7MB

    • memory/2340-11-0x0000000073B60000-0x000000007410B000-memory.dmp

      Filesize

      5.7MB

    • memory/2340-12-0x0000000073B60000-0x000000007410B000-memory.dmp

      Filesize

      5.7MB

    • memory/2340-16-0x0000000006430000-0x0000000007263000-memory.dmp

      Filesize

      14.2MB

    • memory/2340-22-0x0000000073B60000-0x000000007410B000-memory.dmp

      Filesize

      5.7MB

    • memory/2660-21-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2660-23-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB