Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe
Resource
win10v2004-20241007-en
General
-
Target
429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe
-
Size
3.0MB
-
MD5
b98c8b2371f8ba7c52661ceadb9d7c4b
-
SHA1
fe53566a860925c0aa5a6605e76ec3fbe1aa1026
-
SHA256
429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4
-
SHA512
e44d2eb528299f3cce3a7673ecae646a61bb55dd07793f45986f701703dd94ff1db842ef981543dd9734623066605093cc4a14f5a16d46b4dc481195db27c8f0
-
SSDEEP
49152:U/NHiSS3norb/TlvO90d7HjmAFd4A64nsfJNpGixhCAgPKDNjNcx13+l6bKESZ1E:823ntLO501hIz4k2
Malware Config
Signatures
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1728 wrote to memory of 1312 1728 429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe 87 PID 1728 wrote to memory of 1312 1728 429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe 87 PID 1312 wrote to memory of 3960 1312 cmd.exe 88 PID 1312 wrote to memory of 3960 1312 cmd.exe 88 PID 1728 wrote to memory of 4884 1728 429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe 89 PID 1728 wrote to memory of 4884 1728 429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe 89 PID 4884 wrote to memory of 4236 4884 cmd.exe 90 PID 4884 wrote to memory of 4236 4884 cmd.exe 90 PID 1728 wrote to memory of 5104 1728 429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe 91 PID 1728 wrote to memory of 5104 1728 429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe 91 PID 5104 wrote to memory of 3480 5104 cmd.exe 92 PID 5104 wrote to memory of 3480 5104 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe"C:\Users\Admin\AppData\Local\Temp\429c1933e8601dec32dfedc36176987866834877661f240c30a2ca8ab00e2cb4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\cmd.execmd /c "netsh int tcp set supplemental template=internet congestionprovider=ctcp"2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\netsh.exenetsh int tcp set supplemental template=internet congestionprovider=ctcp3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3960
-
-
-
C:\Windows\system32\cmd.execmd /c "netsh int tcp set global ecncapability=enabled"2⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\system32\netsh.exenetsh int tcp set global ecncapability=enabled3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4236
-
-
-
C:\Windows\system32\cmd.execmd /c "netsh int tcp set global initialRto=2000"2⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\netsh.exenetsh int tcp set global initialRto=20003⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3480
-
-