Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

PenlExecutorV5.exe

windows10-2004-x64

10

Resubmissions

03/09/2024, 08:38

240903-kj4klascln 10

03/09/2024, 08:36

240903-kh1gjsscjm 10

03/09/2024, 06:55

240903-hp2l3s1gkh 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PenlExecutorV5.exe

  • Size

    21.7MB

  • Sample

    240903-kh1gjsscjm

  • MD5

    2ab204ea193000dade28d306de97a101

  • SHA1

    b465e38921a355bd93e3224dacbf330665bc69ab

  • SHA256

    a9206417bf18fbe241927419daaf2ba6bdec71d4c130256a59ca6f2e8f89cf8e

  • SHA512

    57a3b37e3f42a33e98b33afc10fdc28bd3247d2ace85772859a63a80fc71676732320e0bda1b6b77565ad8150f6c38ada7800fab76547ec9ced0363ceda1d5dd

  • SSDEEP

    393216:nLct7WGlx0P7z8P/NR5q+5DbqCrqDlJVy2zOeLM+AA+k6zYVz4TUi2I8:ngtpgYP/N/qUDbqgqDjVy2LhhZzEEI

Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerransomwarespywarestealer

Malware Config

Targets

    • Target

      PenlExecutorV5.exe

    • Size

      21.7MB

    • MD5

      2ab204ea193000dade28d306de97a101

    • SHA1

      b465e38921a355bd93e3224dacbf330665bc69ab

    • SHA256

      a9206417bf18fbe241927419daaf2ba6bdec71d4c130256a59ca6f2e8f89cf8e

    • SHA512

      57a3b37e3f42a33e98b33afc10fdc28bd3247d2ace85772859a63a80fc71676732320e0bda1b6b77565ad8150f6c38ada7800fab76547ec9ced0363ceda1d5dd

    • SSDEEP

      393216:nLct7WGlx0P7z8P/NR5q+5DbqCrqDlJVy2zOeLM+AA+k6zYVz4TUi2I8:ngtpgYP/N/qUDbqgqDjVy2LhhZzEEI

    Score
    10/10
    defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerransomwarespywarestealer

    • Disables service(s)

      evasionexecution

    • Renames multiple (173) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Service Stop

2
T1489

Tasks