Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 00:22

General

  • Target

    8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe

  • Size

    78KB

  • MD5

    7bfbe9f42a7aa4e975f7946d44b3260f

  • SHA1

    35b0151f326b99687a8344c5af9e3fb431499ec9

  • SHA256

    8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3

  • SHA512

    7b8d5113fc2642541da57bef8cc7f53eaab22dc0f7c25c93f274ebf9ee17395912e494ebe86b3804547f5677a9bcf2d493a4fdee2f6dbd5501c628d848ea89f1

  • SSDEEP

    1536:9RWtHF3M7t/vZv0kH9gDDtWzYCnJPeoYrGQtRk9/O1GD:9RWtHF8h/l0Y9MDYrm7Rk9/H

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
    "C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i6aa6z4j.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90A7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7F2ECFAE26274B51B0E1CD71E8A847B6.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5044
    • C:\Users\Admin\AppData\Local\Temp\tmp8F6F.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp8F6F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\8153087dbc258f47556148be5da4f5aab0c12ef0a884b6cdab6eff3a8cef45b3.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES90A7.tmp

    Filesize

    1KB

    MD5

    c5a582d771e451547365298b2df1150c

    SHA1

    1b118f7e821f2cc6bd5740085883280be3da8729

    SHA256

    e0a190c310aa03fcd11da6226fdd15a4fb593124e5025f9bceafa27319418cde

    SHA512

    9e105f685deb18b1eb976019124902262cb72a5ac4b4d9a42dd9bc0c4eac482a733d880be703c9f8f84aa8be27da0f76ebb2ce543c545ccfae683b8d2d855405

  • C:\Users\Admin\AppData\Local\Temp\i6aa6z4j.0.vb

    Filesize

    15KB

    MD5

    46210dcdf64f59936184b09fdf8d5217

    SHA1

    71ed9ae5bec5e3da33f39b759aa3f5e4ae450ae7

    SHA256

    8f6f85d37e8065073463d64a0a43ca7bc0f16998b3910ea31de468bf8a31a5e0

    SHA512

    cd24bad9cdd8236c42dfd068fe7da5d684707c1492e0afa10c5b9fb6e9b1eb03dd3858d1d9faf734ea256947805824049a26ad0285d9ca718581f0795e37e929

  • C:\Users\Admin\AppData\Local\Temp\i6aa6z4j.cmdline

    Filesize

    266B

    MD5

    b18798094659bc0f18ab59b328699572

    SHA1

    97d16cf19fc030889dbd2c722965e4a4abb8a924

    SHA256

    5cb9f9f7dbf5043e01d4c3a39711e52af1b6ef1284698dde7b9f213d037493f3

    SHA512

    7d6952e432ba28defda8e1dcb0990e631c9526b10db2c5024fd819d9373f85e4c942f8857e35ffc912749367b28f082a233fdbba4306bd6a2467a9b1bb40fdc1

  • C:\Users\Admin\AppData\Local\Temp\tmp8F6F.tmp.exe

    Filesize

    78KB

    MD5

    f31bfd229f5af6283dc0d47b0b68541f

    SHA1

    1a45ac90f33c2f8967b889a23fb78c9cccda61cc

    SHA256

    91b7b2098002a382e112d4860839d102ead2c0bef23e9782ee3aa24b8b6cd0ef

    SHA512

    622417fc8d450a71eda9c386b9c76e96e9b9f4c0eeaa57f79c0b6fe5204fb1e3d55764f31a4dd67b285c89242346a129e82fef35a432865bc006e51c72eae2a2

  • C:\Users\Admin\AppData\Local\Temp\vbc7F2ECFAE26274B51B0E1CD71E8A847B6.TMP

    Filesize

    660B

    MD5

    bf7b737b6b11c2ae4789bc2e1e4801f6

    SHA1

    f5b8f4c1ab17f12139beed65eefe7e6d56441aa0

    SHA256

    c71dc7c3d16f5e775715f040a4ab33536bae9d9d25983a7c63bf457e76b7c043

    SHA512

    e51f694fc443682a59fb2ef056e2621f055ca8724e92165e24ebeaf425481255c91266f469d8bbbd9a146b71bdc70c13a07bea5506e4fbde473e02634dbe819d

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    8b25b4d931908b4c77ce6c3d5b9a2910

    SHA1

    88b65fd9733484c8f8147dad9d0896918c7e37c7

    SHA256

    79c261ab6b394ee23ab0fd0af48bcd96f914c6bb88b36b6815b6bbf787ecd56e

    SHA512

    6d954066cec5eca118601f2f848f5c9deebe3761ac285c6d45041df22e4bc4e9e2fd98c1aa4fbb6b9c735151bf8d5fffa5acddf7060a4cf3cb7e09271a4a926d

  • memory/1468-23-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1468-24-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1468-26-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1468-27-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1468-28-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1468-29-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1468-30-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1888-8-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/1888-18-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/4940-2-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/4940-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/4940-22-0x0000000074EF0000-0x00000000754A1000-memory.dmp

    Filesize

    5.7MB

  • memory/4940-0-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

    Filesize

    4KB