Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    3s
  • max time network
    4s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/06/2024, 20:50

General

  • Target

    Tournament_Fixer/AdditionalRuntimes/nvrl64.exe

  • Size

    259KB

  • MD5

    6e8599bb5bc6c68d3621304b8a6f2c9c

  • SHA1

    08a67c455f41e3afa91afe4c448973655c19841e

  • SHA256

    168f7fa5ea8971b0b8164ea3d56b8201da27d8b6e9cf80c8c8051a1a1615a92c

  • SHA512

    74a6237ea6787ceeb9ff424633363c5059ad455af79467e096e5b9eeb66eb3b7c8c051db224cb28d5f243c9b9754834efca9dcd959915d3c9a17b21b72e299e8

  • SSDEEP

    6144:UBlkZvaF4NTBBUSm8J01k0lNFbuH5X1Cok2hM6Xks:UoSWNTPUb8A9tbuHl1i2hM6Xd

Malware Config

Signatures

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\nvrl64.exe
    "C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\nvrl64.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7678.tmp\7679.tmp\767A.bat C:\Users\Admin\AppData\Local\Temp\Tournament_Fixer\AdditionalRuntimes\nvrl64.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Windows\system32\netsh.exe
        NETSH WINSOCK RESET
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:4788
      • C:\Windows\system32\netsh.exe
        NETSH INT IP RESET
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:2924
      • C:\Windows\system32\netsh.exe
        NETSH INTERFACE IPV4 RESET
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:4048
      • C:\Windows\system32\netsh.exe
        NETSH INTERFACE IPV6 RESET
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:2020
      • C:\Windows\system32\netsh.exe
        NETSH INTERFACE TCP RESET
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:720
      • C:\Windows\system32\netsh.exe
        NETSH INT RESET ALL
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:4200
      • C:\Windows\system32\ipconfig.exe
        IPCONFIG /RELEASE
        3⤵
        • Gathers network information
        PID:1600
      • C:\Windows\system32\ipconfig.exe
        IPCONFIG /RELEASE
        3⤵
        • Gathers network information
        PID:4060
      • C:\Windows\system32\ipconfig.exe
        IPCONFIG /FLUSHDNS
        3⤵
        • Gathers network information
        PID:1412
      • C:\Windows\system32\nbtstat.exe
        NBTSTAT -R
        3⤵
          PID:4220
        • C:\Windows\system32\nbtstat.exe
          NBTSTAT -RR
          3⤵
            PID:4868
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7678.tmp\7679.tmp\767A.bat

        Filesize

        169KB

        MD5

        7933f4bcf196e8ef425998cc9f1a8a91

        SHA1

        d9a4d1d104425c5e3ccb17581351e5b61d96d69d

        SHA256

        15bf3321b57e08f6cc80c72e7a1ad54eea4ff27d2faccdd8dd10cc5e4adb26fc

        SHA512

        52f0e5d0ba1224b9ffa6bbb9d1ef365288304581d536b3187f69396049a6ff1190c4feb2ee303b5bec46e688843956532911a7dd3bb75a9cb785d4fb358010b5