Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
cool.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cool.exe
Resource
win10v2004-20240802-en
General
-
Target
cool.exe
-
Size
27KB
-
MD5
1ee7cc05d97af21a41db79474906ba91
-
SHA1
9a6434526b3d4766d044da5753de220be164eca1
-
SHA256
1838d564a975fa0c341a4849b8ee1770be6ed48e8d1a0c2a0d8a4e67cc8f567f
-
SHA512
cff758f21406bcbdd1b6a7a749462a751a511e373ef61b978bb5d1ebcd46612f3e53c33de014d473ee623b5445ba03a695252ce354f3fd02f93a9ac996387fea
-
SSDEEP
384:dNqGSj1dStBzyUt5Ldxhw+LGlMz/T/oO7Waqf+BvvE9q+cNB0zS0i5RT44:WGSjeIs++L2MIO78+Bk94zM4
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2024 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3400 cool.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe Token: SeIncBasePriorityPrivilege 3400 cool.exe Token: 33 3400 cool.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3400 wrote to memory of 3248 3400 cool.exe 86 PID 3400 wrote to memory of 3248 3400 cool.exe 86 PID 3400 wrote to memory of 3248 3400 cool.exe 86 PID 3248 wrote to memory of 2024 3248 cmd.exe 88 PID 3248 wrote to memory of 2024 3248 cmd.exe 88 PID 3248 wrote to memory of 2024 3248 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\cool.exe"C:\Users\Admin\AppData\Local\Temp\cool.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MyFolder\\.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cool.exe" "cool.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159B
MD54ba9602a5b672444376badef7b11b4ed
SHA167c1af161bb7dc35d2ba03ac2f82102065e86e92
SHA25635c4a10ad67b3a19ada80c11d00e8b6adb765ab764b8c9ccce99b86d041bfaac
SHA5122cba746114d15b1c7da714fedcbb80c83c1697ed68baa42524be4d3db65cddeabdd68efc7fd1facaf225004446ad1814e9e012c064d2e23f311b5fc327c3122e