Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
trigger.ps1
Resource
win7-20240903-en
General
-
Target
trigger.ps1
-
Size
116B
-
MD5
136bd5042c063ee3047b2cf91ce3a13e
-
SHA1
8ee372eff6166cea45b32f40008dca9a61a75b5a
-
SHA256
071bdff08a6119b3a845f1dd9b10f7b7ead26e56b845137d4e5a96538bb917d4
-
SHA512
4fca5f9b18251a2ee461fa2406f4387749ac183262f20001c270d544a2bf5272dabd0b2beb886384e9e9525f63d37cb938741151128a5baa3077d1a8c7fe722d
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 17 4140 powershell.exe 21 4140 powershell.exe 27 4140 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1208 beks.exe -
Loads dropped DLL 1 IoCs
pid Process 1208 beks.exe -
pid Process 4140 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language beks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4140 powershell.exe 4140 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4140 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4140 wrote to memory of 1208 4140 powershell.exe 89 PID 4140 wrote to memory of 1208 4140 powershell.exe 89 PID 4140 wrote to memory of 1208 4140 powershell.exe 89
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\trigger.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Roaming\Hashed\beks.exe"C:\Users\Admin\AppData\Roaming\Hashed\beks.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4.8MB
MD502a3ff6cf40a59890512e2199c3a3256
SHA1ab40be16054aeb4329b365d7ccc3f62d214522dc
SHA256a539405f9e4c86ce4ade7fdfe39ecc2da493083654f5cd6662bb14b9bbb9ca53
SHA512f5fc68275c9d9ae0e0c3d9a6f20bc05a9e2c58ffe8f82798d7cd4df1115386a774459460fe375a03b48af17bdc663b5136743c5fa6e6ff85b2758f69fc80b599
-
Filesize
5.7MB
MD52a53c7f50b074db464f7dacfcbad3be8
SHA137061b97ecf311c6165832293f55928fc31dd0c4
SHA256ee5c5dd1aee927a6bcb8e390a0d2c5adcda66da5ec9e7d41b22014dd3181e793
SHA5122384285ebbcc43a409f4cbec20e7e129502804683b1274d1a087e83289523fa9ba6b74243eaa96bd051fb072e16facc5bbbffde818aaa2857cd66463c43199b2