Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    5s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/10/2024, 22:12

General

  • Target

    cad8c73ebaabdfc1557482f83e18d543be6bd15e723bb89670398f8c4a3e2181N.exe

  • Size

    70KB

  • MD5

    028940e1f2ecb5ef9aba3dcd590d3260

  • SHA1

    066d9db987d05c89b055f2f870ce76af4930ae9c

  • SHA256

    cad8c73ebaabdfc1557482f83e18d543be6bd15e723bb89670398f8c4a3e2181

  • SHA512

    a075c6d5923b5978bbb20f0bee773a46b698fa7ad946aa57f98dc51f5403fe6cc9b8e07f35bfaf457f6d386f3d213e2f63d7404cf4840a9a991197ddf77202ca

  • SSDEEP

    1536:gFTnqpKxynVZGeifCSzTPb542HkLbvJfxa:gFT0Geifrvb59H+bvJ5a

Malware Config

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • BlackNET payload 1 IoCs
  • Blacknet family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cad8c73ebaabdfc1557482f83e18d543be6bd15e723bb89670398f8c4a3e2181N.exe
    "C:\Users\Admin\AppData\Local\Temp\cad8c73ebaabdfc1557482f83e18d543be6bd15e723bb89670398f8c4a3e2181N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

    Filesize

    70KB

    MD5

    028940e1f2ecb5ef9aba3dcd590d3260

    SHA1

    066d9db987d05c89b055f2f870ce76af4930ae9c

    SHA256

    cad8c73ebaabdfc1557482f83e18d543be6bd15e723bb89670398f8c4a3e2181

    SHA512

    a075c6d5923b5978bbb20f0bee773a46b698fa7ad946aa57f98dc51f5403fe6cc9b8e07f35bfaf457f6d386f3d213e2f63d7404cf4840a9a991197ddf77202ca

  • memory/3696-46-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-51-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-55-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-54-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-53-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-52-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-39-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-50-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-49-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-48-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-56-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-47-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-44-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-57-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-28-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-29-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-45-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-43-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-30-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-42-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-41-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-40-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-37-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3696-38-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-13-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-35-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-36-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-33-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-31-0x00007FFBA91D5000-0x00007FFBA91D6000-memory.dmp

    Filesize

    4KB

  • memory/4272-32-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-15-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-14-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-0-0x00007FFBA91D5000-0x00007FFBA91D6000-memory.dmp

    Filesize

    4KB

  • memory/4272-10-0x000000001F660000-0x000000001F6C2000-memory.dmp

    Filesize

    392KB

  • memory/4272-9-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-8-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-6-0x00000000013C0000-0x00000000013C8000-memory.dmp

    Filesize

    32KB

  • memory/4272-7-0x000000001C4B0000-0x000000001C4FC000-memory.dmp

    Filesize

    304KB

  • memory/4272-5-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-4-0x000000001C3A0000-0x000000001C43C000-memory.dmp

    Filesize

    624KB

  • memory/4272-3-0x000000001BE30000-0x000000001C2FE000-memory.dmp

    Filesize

    4.8MB

  • memory/4272-2-0x00007FFBA8F20000-0x00007FFBA98C1000-memory.dmp

    Filesize

    9.6MB

  • memory/4272-1-0x000000001B810000-0x000000001B8B6000-memory.dmp

    Filesize

    664KB