Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-es -
resource tags
arch:x64arch:x86image:win10v2004-20240508-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
29/06/2024, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
NetViper.exe
Resource
win10v2004-20240508-es
General
-
Target
NetViper.exe
-
Size
23.7MB
-
MD5
16dd17e3dc95a095a4af9d7672ec66d7
-
SHA1
981177bf2105e9d3a4e59c14cf6ec1546bb581b6
-
SHA256
2489abfdf14ba353610faf01c3100a5864c1b8b2be744f971718a3cbb43ea1b1
-
SHA512
ac9025e3269f1542f7b97717048f13d0824c954b32cbd3358f7fc9cc404cedb96f5fd842e90cf462406faabe6451e23d8fd7a9433911cd3b8d7836957f84784a
-
SSDEEP
393216:gOySKOW8NsyKQsPrSXNtuNCLNxJVKLMiAH2pyQvLe8ifktx8AQCYXkRB:MSKnUK1S9JLNxJVKU2pJiCQCYW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5040 NetViperOBF.exe -
Loads dropped DLL 28 IoCs
pid Process 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe 5040 NetViperOBF.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2076 wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5040 NetViperOBF.exe Token: SeIncreaseQuotaPrivilege 544 wmic.exe Token: SeSecurityPrivilege 544 wmic.exe Token: SeTakeOwnershipPrivilege 544 wmic.exe Token: SeLoadDriverPrivilege 544 wmic.exe Token: SeSystemProfilePrivilege 544 wmic.exe Token: SeSystemtimePrivilege 544 wmic.exe Token: SeProfSingleProcessPrivilege 544 wmic.exe Token: SeIncBasePriorityPrivilege 544 wmic.exe Token: SeCreatePagefilePrivilege 544 wmic.exe Token: SeBackupPrivilege 544 wmic.exe Token: SeRestorePrivilege 544 wmic.exe Token: SeShutdownPrivilege 544 wmic.exe Token: SeDebugPrivilege 544 wmic.exe Token: SeSystemEnvironmentPrivilege 544 wmic.exe Token: SeRemoteShutdownPrivilege 544 wmic.exe Token: SeUndockPrivilege 544 wmic.exe Token: SeManageVolumePrivilege 544 wmic.exe Token: 33 544 wmic.exe Token: 34 544 wmic.exe Token: 35 544 wmic.exe Token: 36 544 wmic.exe Token: SeIncreaseQuotaPrivilege 544 wmic.exe Token: SeSecurityPrivilege 544 wmic.exe Token: SeTakeOwnershipPrivilege 544 wmic.exe Token: SeLoadDriverPrivilege 544 wmic.exe Token: SeSystemProfilePrivilege 544 wmic.exe Token: SeSystemtimePrivilege 544 wmic.exe Token: SeProfSingleProcessPrivilege 544 wmic.exe Token: SeIncBasePriorityPrivilege 544 wmic.exe Token: SeCreatePagefilePrivilege 544 wmic.exe Token: SeBackupPrivilege 544 wmic.exe Token: SeRestorePrivilege 544 wmic.exe Token: SeShutdownPrivilege 544 wmic.exe Token: SeDebugPrivilege 544 wmic.exe Token: SeSystemEnvironmentPrivilege 544 wmic.exe Token: SeRemoteShutdownPrivilege 544 wmic.exe Token: SeUndockPrivilege 544 wmic.exe Token: SeManageVolumePrivilege 544 wmic.exe Token: 33 544 wmic.exe Token: 34 544 wmic.exe Token: 35 544 wmic.exe Token: 36 544 wmic.exe Token: SeIncreaseQuotaPrivilege 2076 wmic.exe Token: SeSecurityPrivilege 2076 wmic.exe Token: SeTakeOwnershipPrivilege 2076 wmic.exe Token: SeLoadDriverPrivilege 2076 wmic.exe Token: SeSystemProfilePrivilege 2076 wmic.exe Token: SeSystemtimePrivilege 2076 wmic.exe Token: SeProfSingleProcessPrivilege 2076 wmic.exe Token: SeIncBasePriorityPrivilege 2076 wmic.exe Token: SeCreatePagefilePrivilege 2076 wmic.exe Token: SeBackupPrivilege 2076 wmic.exe Token: SeRestorePrivilege 2076 wmic.exe Token: SeShutdownPrivilege 2076 wmic.exe Token: SeDebugPrivilege 2076 wmic.exe Token: SeSystemEnvironmentPrivilege 2076 wmic.exe Token: SeRemoteShutdownPrivilege 2076 wmic.exe Token: SeUndockPrivilege 2076 wmic.exe Token: SeManageVolumePrivilege 2076 wmic.exe Token: 33 2076 wmic.exe Token: 34 2076 wmic.exe Token: 35 2076 wmic.exe Token: 36 2076 wmic.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4692 wrote to memory of 5040 4692 NetViper.exe 82 PID 4692 wrote to memory of 5040 4692 NetViper.exe 82 PID 5040 wrote to memory of 3532 5040 NetViperOBF.exe 83 PID 5040 wrote to memory of 3532 5040 NetViperOBF.exe 83 PID 5040 wrote to memory of 2368 5040 NetViperOBF.exe 86 PID 5040 wrote to memory of 2368 5040 NetViperOBF.exe 86 PID 5040 wrote to memory of 544 5040 NetViperOBF.exe 87 PID 5040 wrote to memory of 544 5040 NetViperOBF.exe 87 PID 5040 wrote to memory of 2076 5040 NetViperOBF.exe 90 PID 5040 wrote to memory of 2076 5040 NetViperOBF.exe 90 PID 5040 wrote to memory of 4732 5040 NetViperOBF.exe 92 PID 5040 wrote to memory of 4732 5040 NetViperOBF.exe 92 PID 5040 wrote to memory of 1268 5040 NetViperOBF.exe 93 PID 5040 wrote to memory of 1268 5040 NetViperOBF.exe 93 PID 1268 wrote to memory of 2996 1268 cmd.exe 94 PID 1268 wrote to memory of 2996 1268 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\NetViper.exe"C:\Users\Admin\AppData\Local\Temp\NetViper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\onefile_4692_133641440947518996\NetViperOBF.exe"C:\Users\Admin\AppData\Local\Temp\NetViper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:3532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:2368
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls || clear3⤵PID:4732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con: cols=120 lines=403⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\system32\mode.commode con: cols=120 lines=404⤵PID:2996
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD5ca4cef051737b0e4e56b7d597238df94
SHA1583df3f7ecade0252fdff608eb969439956f5c4a
SHA256e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
SHA51217103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3
-
Filesize
242KB
MD56339fa92584252c3b24e4cce9d73ef50
SHA1dccda9b641125b16e56c5b1530f3d04e302325cd
SHA2564ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
SHA512428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84
-
Filesize
153KB
MD50a94c9f3d7728cf96326db3ab3646d40
SHA18081df1dca4a8520604e134672c4be79eb202d14
SHA2560a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
SHA5126f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087
-
Filesize
47KB
MD502c0f2eff280b9a92003786fded7c440
SHA15a7fe7ed605ff1c49036d001ae60305e309c5509
SHA256f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973
SHA5122b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac
-
Filesize
75KB
MD50f5e64e33f4d328ef11357635707d154
SHA18b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA2568af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
SHA5124be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
-
Filesize
155KB
MD59ddb64354ef0b91c6999a4b244a0a011
SHA186a9dc5ea931638699eb6d8d03355ad7992d2fee
SHA256e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
SHA5124c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca
-
Filesize
10KB
MD5f0027550d46509b0514cf2bf0cc162bc
SHA15b5a9fd863a216b2444ccbd51b1f451d6eca8179
SHA25677300a458bb8dc0d4ff4d8bddb3289e90cb079418dbed3e20d2c9a445f39746e
SHA512bb09b814dbe3e4361abbafec4768208c98a7f455ef311b653d61b0b6098197bdac43e74e2e3868e486819f147b8f7c442c76e5181cc5a7eb13b6e2c2e07bf9b7
-
Filesize
111KB
MD5e9454a224d11e1bd68c7069b7f5f61a7
SHA1793098653d93652415f8bace81434f6f4490cf1a
SHA256711f292ace44576f5de4f592adebd9d21faf569357c289425251d8dce4fa84cc
SHA51217d993a0c4b56219e8c224eb2bdea92d9cc4bd3809b0f9fa4cf0ddfdc5eab4371441d488ea851abf2f88c691d57a268d5cdcaa9d11d4dd091bc130638fe36460
-
Filesize
6.3MB
MD523b2d3aac2a873e981c0539eea21d2b3
SHA1679249f218c46025b0572714beba5a288e6d6eb9
SHA25658339e750fd6cee450aa21fbbd1657c78ef84b9d35503750696372c8aa845ec7
SHA51218c559df7dd992c55c247ef541693737a192fd5f5e94ae36116c4a23bad73623a46994ffc521bf81fa67ccedb571f1d886d7f45e50f6904bacf1c5e32ccddffe
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
39KB
MD5a4c988361c7f69e080de5eb1a6c3f5cd
SHA186d77b7a17c79a1db9c6790b23b0702b245ed94c
SHA25602d867d8f8120658255c6e5ec426010c149fe353795f79326fe5de3e849fc6c8
SHA512dc73a144dc007ed9b207e9ca02e3a8663e705f71e3873d5d883e7e3fecba3d6268b4fa59a1f88db023d4b98aaef6fc5677e7269fff0c2c0e4eab8f98e57b062a
-
Filesize
1.1MB
MD54c8af8a30813e9380f5f54309325d6b8
SHA1169a80d8923fb28f89bc26ebf89ffe37f8545c88
SHA2564b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
SHA512ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a
-
Filesize
42.8MB
MD58e1d610032e62cf14ff58b3174118936
SHA15e6a8d42bd383f53c666029b53a3b5e97340abb1
SHA2564691f4df1955635c9976950e371b46be999c4c4ec387d3e442047609c23ae59f
SHA51268c949378aa6c884ef206926e13d14f4181b6466dd17c758476e1434499a1dd274f7c672d7c0ca57332c06db738bfebb49df489f758fd1a6b09aa5c1ac1fb337
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
62KB
MD54543813a21958d0764975032b09ded7b
SHA1c571dea89ab89b6aab6da9b88afe78ace90dd882
SHA25645c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5
SHA5123b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f
-
Filesize
81KB
MD5bbe89cf70b64f38c67b7bf23c0ea8a48
SHA144577016e9c7b463a79b966b67c3ecc868957470
SHA256775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
SHA5123ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1
-
Filesize
177KB
MD56f1b90884343f717c5dc14f94ef5acea
SHA1cca1a4dcf7a32bf698e75d58c5f130fb3572e423
SHA2562093e7e4f5359b38f0819bdef8314fda332a1427f22e09afc416e1edd5910fe1
SHA512e2c673b75162d3432bab497bad3f5f15a9571910d25f1dffb655755c74457ac78e5311bd5b38d29a91aec4d3ef883ae5c062b9a3255b5800145eb997863a7d73
-
Filesize
60KB
MD5d856a545a960bf2dca1e2d9be32e5369
SHA167a15ecf763cdc2c2aa458a521db8a48d816d91e
SHA256cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
SHA51234a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4
-
Filesize
29KB
MD552d0a6009d3de40f4fa6ec61db98c45c
SHA15083a2aff5bcce07c80409646347c63d2a87bd25
SHA256007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
SHA512cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824
-
Filesize
23KB
MD5041556420bdb334a71765d33229e9945
SHA10122316e74ee4ada1ce1e0310b8dca1131972ce1
SHA2568b3d4767057c18c1c496e138d4843f25e5c98ddfc6a8d1b0ed46fd938ede5bb6
SHA51218da574b362726ede927d4231cc7f2aebafbaaab47df1e31b233f7eda798253aef4c142bed1a80164464bd629015d387ae97ba36fcd3cedcfe54a5a1e5c5caa3
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
76KB
MD5ebefbc98d468560b222f2d2d30ebb95c
SHA1ee267e3a6e5bed1a15055451efcccac327d2bc43
SHA25667c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478
SHA512ab9f949adfe9475b0ba8c37fa14b0705923f79c8a10b81446abc448ad38d5d55516f729b570d641926610c99df834223567c1efde166e6a0f805c9e2a35556e3
-
Filesize
63KB
MD5c17b7a4b853827f538576f4c3521c653
SHA16115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA5128e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
-
Filesize
28KB
MD5c119811a40667dca93dfe6faa418f47a
SHA1113e792b7dcec4366fc273e80b1fc404c309074c
SHA2568f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
SHA512107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3
-
Filesize
11KB
MD548ba38f0b28a75a14d0ac1226fefa30a
SHA1f572ebf92e24deab71a905a68b2bde90ebaf9923
SHA256bc7014c4d6a6c27128a28bfab359aecd29562f374aa1abdc88c063f1e498fae4
SHA51273713bf83fbcf216afc6f10cc768990d6be6d9e30189dbfa3960a5c027ca3758912649f7e7a00dcc83163e1580a4f54d4c2ed04de95c54034321f7d294a43d3c