Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 01:22

General

  • Target

    33f7f66665c08153601d8fcd5f84defba46cf09af23cfcc72361f2a17d49d63dN.exe

  • Size

    78KB

  • MD5

    b0ec359e94b58d69c223e0ddf544c000

  • SHA1

    be2360bf717a87109b52995bd815b5b1d22f5d17

  • SHA256

    33f7f66665c08153601d8fcd5f84defba46cf09af23cfcc72361f2a17d49d63d

  • SHA512

    ac7a5b1c0a44a830affea41673122a599765b9cdb3ae2b59bd1aaecbbcc6eb201b928831b4bf023bf5c8b59eb077c5b37caf6a2b6b864c720602ec04b09b879f

  • SSDEEP

    1536:5CHY6M7t4XT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtW9/61b8:5CHYnhASyRxvhTzXPvCbW2UW9/3

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33f7f66665c08153601d8fcd5f84defba46cf09af23cfcc72361f2a17d49d63dN.exe
    "C:\Users\Admin\AppData\Local\Temp\33f7f66665c08153601d8fcd5f84defba46cf09af23cfcc72361f2a17d49d63dN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n4mleo2w.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8760.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc11993C47AA504BC795D5A3BB28F13DC.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:860
    • C:\Users\Admin\AppData\Local\Temp\tmp8628.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp8628.tmp.exe" C:\Users\Admin\AppData\Local\Temp\33f7f66665c08153601d8fcd5f84defba46cf09af23cfcc72361f2a17d49d63dN.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES8760.tmp

    Filesize

    1KB

    MD5

    60e7395e4c947a714166d5815dede34b

    SHA1

    e50083fba6a9cfcba1f6fd43ac50245236af8438

    SHA256

    b6e05e284920bd95e4c87a2813ca018f1891f75960fb1c7cd2b02ada13d86388

    SHA512

    aca90b75357986e7e324a2d3ade06ece67c3cc3289b89b65975b5eff607da75178aa18f9a694fd44876fc4601ebca7ea33e0b9d21ca1f8fccd65fa607c13f71e

  • C:\Users\Admin\AppData\Local\Temp\n4mleo2w.0.vb

    Filesize

    15KB

    MD5

    0a3e76ac989c23d6ef02ffdf10fc1aa1

    SHA1

    3ed0f01a21894fb1e09fbba654c9b6e0cd312992

    SHA256

    d171865b9908904009f13a7fb17e731333a47d302521028928c0351c963841ae

    SHA512

    4b684847254b42aa4fb80fd2c779cf8260b065f11dc30fb2ef86aa38f1cf829ecca3558a39cd551da125035e2cc0fe19be95e689533b17e471353b4a162c4ab1

  • C:\Users\Admin\AppData\Local\Temp\n4mleo2w.cmdline

    Filesize

    266B

    MD5

    c25a90b59ab1f0770f85b42efe7e1d59

    SHA1

    41659ae7e408a85f49e967ce6b56ec5c2194e1f4

    SHA256

    87e21ae27a3fdd04b1199713bb53f8c0802bd14846bf622a5073ced1e0543427

    SHA512

    3e7f89a7f90f127090a434c35472e603b8123a63127eea296637f8af10842f9d2d16295e92e3bfc2135a9ed2b31d960b948ab8ad137e239f7ffe43498a893dca

  • C:\Users\Admin\AppData\Local\Temp\tmp8628.tmp.exe

    Filesize

    78KB

    MD5

    82c18c8bfd9cbae9579be768d675e325

    SHA1

    1287ffc6c7e5095d8097117854b37ae6fefdbeff

    SHA256

    7e685afada3133f65abeed3e41017de97bf60c6a2b3fc4cb49ada4e7868ff834

    SHA512

    1a2afa9b298060080c70349473a2acac72152919e79abd52a79e6c5a7c777e2e61f776b142c66ea0f0becd45583478b335b6d724d8b365eaef588b00e4d381e1

  • C:\Users\Admin\AppData\Local\Temp\vbc11993C47AA504BC795D5A3BB28F13DC.TMP

    Filesize

    660B

    MD5

    7ac6231fa93fe87606fbcdaa8cc884c4

    SHA1

    cc62cd2be8c39ff09f5feb30c7bb89f2c5d75d22

    SHA256

    ab0346f4c173cae1cb44e6e31edc7db769cf46d1d2a89f96d0bde7417e1773b9

    SHA512

    3b8ed6dbd4e4d3c7a471f12ff600abd12efa1de8b7bb1b93d31c63df8c69d973dc0ed7a3b7ff9b4b4773c1e7245a92987ab67771268a3e78b00cd0507e4a3bb1

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    8fd8e054ba10661e530e54511658ac20

    SHA1

    72911622012ddf68f95c1e1424894ecb4442e6fd

    SHA256

    822d92b6f2bd74ba785aa1555b5963c9d7736be1a41241927343dff1caf538d7

    SHA512

    c14d729a30b055df18cfac5258c30574ca93bd05fb9a86b4be47ed041c7a4ceefa636bf1c2dd0ccd4c922eda785ce80127374fb70f965c1cf7cd323da5c1b24c

  • memory/1424-27-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/1424-26-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/1424-25-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/1424-23-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4156-8-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/4156-18-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/5000-22-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/5000-0-0x0000000074F22000-0x0000000074F23000-memory.dmp

    Filesize

    4KB

  • memory/5000-2-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB

  • memory/5000-1-0x0000000074F20000-0x00000000754D1000-memory.dmp

    Filesize

    5.7MB