Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 11:33

General

  • Target

    356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe

  • Size

    2.7MB

  • MD5

    15fbc3057d25e308e0832ad1a7d62e26

  • SHA1

    c90180b2360b4f12a32630f007b3e560d06be558

  • SHA256

    356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61

  • SHA512

    9ce05267bfdfdaa8f20670b885530aac0c7a13cfe01f8b15b5624318f5948462b6cdd7bc523b3fda3ed06ddaacc81d85a99d36af4f6b711d396f03018204f14a

  • SSDEEP

    49152:g7XlYr35b3BZENDqOwwKUv9sZ76Sq+m0Zaupr7/EDXhFlD:4Xl839jEYOwPg+KsEbhP

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
    "C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Windows\SYSTEM32\netsh.exe
      netsh firewall add allowedprogram"C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe" "356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61" ENABLE
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:848
    • C:\Windows\SYSTEM32\netsh.exe
      netsh firewall add allowedprogram"C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe" "356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61" ENABLE
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:896
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61" /tr "C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2236
  • C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
    C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
    1⤵
      PID:1616
    • C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
      C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
      1⤵
        PID:4776
      • C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
        C:\Users\Admin\AppData\Local\Temp\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe
        1⤵
          PID:4464

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\356f56cabcc406f1600831cbd209f3b177037986443a6e3681a54f1b6b25ce61.exe.log

          Filesize

          1KB

          MD5

          a8a147915e3a996fdbe10b3a3f1e1bb2

          SHA1

          abc564c1be468d57e700913e7b6cf8f62d421263

          SHA256

          8b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e

          SHA512

          17b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c

        • memory/1280-0-0x00007FFE633F3000-0x00007FFE633F5000-memory.dmp

          Filesize

          8KB

        • memory/1280-1-0x0000022ED6D90000-0x0000022ED7054000-memory.dmp

          Filesize

          2.8MB

        • memory/1280-2-0x00007FFE633F0000-0x00007FFE63EB1000-memory.dmp

          Filesize

          10.8MB

        • memory/1280-3-0x0000022EF1670000-0x0000022EF1920000-memory.dmp

          Filesize

          2.7MB

        • memory/1280-7-0x00007FFE633F0000-0x00007FFE63EB1000-memory.dmp

          Filesize

          10.8MB