Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 13:10

General

  • Target

    ce9e984a86f425de286533d674207ddc19ca5df723d3dc2a4334b14eaed07aa8N.exe

  • Size

    78KB

  • MD5

    25948a6c3218dbfcaae96f2e3c3a14f0

  • SHA1

    f57137bba0e9610dac65f2780f5ffde89f693618

  • SHA256

    ce9e984a86f425de286533d674207ddc19ca5df723d3dc2a4334b14eaed07aa8

  • SHA512

    d2a3d3d58bae8d1293c4afd7b93253bf2b377043c94740f6720991771ce350a4c448fbbdae9baebd3f4313b97635d3ab9289e94830f3698e07b416b5c7533772

  • SSDEEP

    1536:nsHHuaJtVpJywt04wbje3IgTazcoOEEQLwdCRoaeuProYMHQts9/R1ss:nsH/3DJywQjDgTLopLwdCFJzs9/l

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce9e984a86f425de286533d674207ddc19ca5df723d3dc2a4334b14eaed07aa8N.exe
    "C:\Users\Admin\AppData\Local\Temp\ce9e984a86f425de286533d674207ddc19ca5df723d3dc2a4334b14eaed07aa8N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dq1tywck.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8491.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc63B28351FCE947F394CD2205C3368D5.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2400
    • C:\Users\Admin\AppData\Local\Temp\tmp833A.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp833A.tmp.exe" C:\Users\Admin\AppData\Local\Temp\ce9e984a86f425de286533d674207ddc19ca5df723d3dc2a4334b14eaed07aa8N.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES8491.tmp

    Filesize

    1KB

    MD5

    0e8662ae7f43648758c63b3c9a2ec9df

    SHA1

    4c11661ffe898d76b2ae3176a1bddaa315387da4

    SHA256

    9ed700696e9aa77b5a0a60ff9c93e1b83d3659c4a3770201f570d0249209bc1c

    SHA512

    270061f1928065d89643a9e3daff461b7f8f9d9da3903f102da77fcfea7ad5de98e065978276fa919a25bae09ffe2823b0c876bad7975297819ce784e84e8991

  • C:\Users\Admin\AppData\Local\Temp\dq1tywck.0.vb

    Filesize

    15KB

    MD5

    7e32749904404f8d824d26cbce13709b

    SHA1

    9f7cc3b12a3c15bb3f1aad35e44f1e70650aea6e

    SHA256

    8f821d71ac815ad6546f98f1c532228d5fe67c3e27dd8af1d517779fb81b7df5

    SHA512

    fc023fbc581da421957c7a988b583dc3003e3bb9d54b0a42a99a32de571c8ca14dcc87f5dfe3c514728eb6b862f7e1a2ce0ca6914bd709f2c7eea29ca1f833f2

  • C:\Users\Admin\AppData\Local\Temp\dq1tywck.cmdline

    Filesize

    266B

    MD5

    0482622a736444e1eeb1cab7b4980a96

    SHA1

    f350979d0668b22b31d9adbd1db41706dafa691a

    SHA256

    e7dfa1e3e386b4690da372de2799829414f2b4679aaaaf2c93484c0461741c52

    SHA512

    e54eebe042a49eb8dfeedfb3689171e814fac1860f3531a515721f074d94cf9a499e50a93b16f39bb5a918b630066bba224b1c370d850ec9b16916cb7991e41d

  • C:\Users\Admin\AppData\Local\Temp\tmp833A.tmp.exe

    Filesize

    78KB

    MD5

    d74a838f582193b01a1c041b2d2b89fe

    SHA1

    952d29bee9881299a7c81f36e058c79ba071fd3a

    SHA256

    602f0a5334ee265540948233c4b14285eca1f352eec39917f58ce8ff1705f259

    SHA512

    8accf2bcb47da7ace9521b98409d154b9950754546e5545d89b7e90813763872984b8d8f13e258ddd2cd7473a631e2a463146ea5d23591ba2d98e80c8c4f2c32

  • C:\Users\Admin\AppData\Local\Temp\vbc63B28351FCE947F394CD2205C3368D5.TMP

    Filesize

    660B

    MD5

    f01bfb943961226f395e8f44c4f3d363

    SHA1

    4f3bd937b98bc59b9b66fa894ace6c1e368f7cb8

    SHA256

    9d46d8d5c7b5ef49bb19546d06938b1c19f1db910d9c0d765ca841ac859224ac

    SHA512

    91196300924bc9a9532c4e260990bbd666b185750271bfdcd0929c75fc85a73817fb8763badd0e877b58921553d6306820cc107735fd3ccc1c112635d090cf4a

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    484967ab9def8ff17dd55476ca137721

    SHA1

    a84012f673fe1ac9041e7827cc3de4b20a1194e2

    SHA256

    9c0a54047f133cf4e3e4444aa57cc576c566218217ea02ad7c04a408ad01791b

    SHA512

    1e9a0cc800543dada73e551ee714001c4d6c57a595ea2986a4dd8889d1dffd1557735580c694e5feb0b7c27c1a4b3e71a95fab8baf80839f42f80e2109cbe2d7

  • memory/2164-22-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-2-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-1-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2164-0-0x00000000754B2000-0x00000000754B3000-memory.dmp

    Filesize

    4KB

  • memory/2844-8-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/2844-18-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/4836-23-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/4836-24-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/4836-25-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/4836-26-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB

  • memory/4836-27-0x00000000754B0000-0x0000000075A61000-memory.dmp

    Filesize

    5.7MB