Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
a6b3b195fc729456c47573cc58f7b420.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a6b3b195fc729456c47573cc58f7b420.exe
Resource
win10v2004-20240611-en
General
-
Target
a6b3b195fc729456c47573cc58f7b420.exe
-
Size
160KB
-
MD5
a6b3b195fc729456c47573cc58f7b420
-
SHA1
1a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
-
SHA256
5e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
-
SHA512
eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11
-
SSDEEP
3072:aKZFby2LWGwwgtkpmOgUkimSGX1sz3+l3dfd1:Dby2yGwwgtQmOgUkiDGX1sL+lNl
Malware Config
Extracted
netwire
rop-s.ru:3360
-
activex_autorun
true
-
activex_key
{12VT1G0W-4N37-8VXY-40Y3-HP5QCF1KT4P3}
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\microsofts\iexplore.exe
-
keylogger_dir
%AppData%\microsofts\Logs\
-
lock_executable
false
-
mutex
fortune
-
offline_keylogger
true
-
password
fortune
-
registry_autorun
true
-
startup_name
iexplore
-
use_mutex
true
Signatures
-
NetWire RAT payload 5 IoCs
resource yara_rule behavioral2/memory/724-9-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/724-20-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/2016-14-0x0000000000660000-0x0000000000760000-memory.dmp netwire behavioral2/memory/724-12-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral2/memory/4684-42-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12VT1G0W-4N37-8VXY-40Y3-HP5QCF1KT4P3} iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12VT1G0W-4N37-8VXY-40Y3-HP5QCF1KT4P3}\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\iexplore.exe\"" iexplore.exe -
Executes dropped EXE 2 IoCs
pid Process 652 iexplore.exe 4684 iexplore.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplore = "C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\iexplore.exe" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2016 set thread context of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 652 set thread context of 4684 652 iexplore.exe 84 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2016 a6b3b195fc729456c47573cc58f7b420.exe 652 iexplore.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 2016 wrote to memory of 724 2016 a6b3b195fc729456c47573cc58f7b420.exe 82 PID 724 wrote to memory of 652 724 a6b3b195fc729456c47573cc58f7b420.exe 83 PID 724 wrote to memory of 652 724 a6b3b195fc729456c47573cc58f7b420.exe 83 PID 724 wrote to memory of 652 724 a6b3b195fc729456c47573cc58f7b420.exe 83 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84 PID 652 wrote to memory of 4684 652 iexplore.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"C:\Users\Admin\AppData\Local\Temp\a6b3b195fc729456c47573cc58f7b420.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"C:\Users\Admin\AppData\Roaming\microsofts\iexplore.exe"4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
PID:4684
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5a6b3b195fc729456c47573cc58f7b420
SHA11a388ba57f09225eed3a4fed6a9a9b8b7f16bcfd
SHA2565e6936004864f0ea2ca948645cf3a73610b08b61e28dd9dd9abd37c3a7097df2
SHA512eec3a6e00461fd8f7293522df11a018daffd4d3716e35c2448743e7169b73d798dfbf4a82b8edc896df1a29653cfcad218dbb1048457b6c3eaed7cb127d2ff11