Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2024, 12:15

General

  • Target

    c1c2dca754085aff5214da6e196b7973da114eabc1632d077a505504d950acaf.exe

  • Size

    203KB

  • MD5

    2b25a25533263e914b40e9438348936a

  • SHA1

    b9b40f955274aed3658dc3301da40bfec1a6508d

  • SHA256

    c1c2dca754085aff5214da6e196b7973da114eabc1632d077a505504d950acaf

  • SHA512

    3d2e5d5e1cb1c8f7948f9dffe3da2cdffdd1ad185757c7a447ad7f20526c8fee732f64fdfd3066505a1e863792d8d54a8574400a11825cc1569c997046a8ca44

  • SSDEEP

    6144:MLV6Bta6dtJmakIM5x6V2qhLyNPYTbEjH:MLV6BtpmkKM2uL4YTS

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Nanocore family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1c2dca754085aff5214da6e196b7973da114eabc1632d077a505504d950acaf.exe
    "C:\Users\Admin\AppData\Local\Temp\c1c2dca754085aff5214da6e196b7973da114eabc1632d077a505504d950acaf.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCC68.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3580
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "LAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCCC7.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpCC68.tmp

    Filesize

    1KB

    MD5

    99f05727d36cda5ef9f328ff90aa34c0

    SHA1

    a0dba9e90e64b12b9445a37cda0432250f9fa32f

    SHA256

    816782515ce1bf42051eda2a0ef91e079da046b9ae5ff91fc4b4eb1926253ed8

    SHA512

    27e5347d6adb9a522eee750dace5a4896cbe87095dddaa98fdb651cb982fa86585af937419fd261840b26caf35cc39e87f0bbfb050afb05fb1a5e5a747480066

  • C:\Users\Admin\AppData\Local\Temp\tmpCCC7.tmp

    Filesize

    1KB

    MD5

    6b30dba7972c92c9a1b881e88c108b15

    SHA1

    f76207985cc5a1f70edb2fb5bd45678f195a4564

    SHA256

    578f5b0ff051f02f8e0a67fc3424dad554fa9489875475ea624fbb63eabfcbf7

    SHA512

    e3dd368937f863cb07453de12173580fb63b8d3983db7119c24860f227c89ded76401c47607f5b1134d215d46fe2b40d4bc3d7299374f1e8abecdeaefc7b9099

  • memory/4332-0-0x0000000074F42000-0x0000000074F43000-memory.dmp

    Filesize

    4KB

  • memory/4332-1-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4332-2-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4332-10-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4332-11-0x0000000074F42000-0x0000000074F43000-memory.dmp

    Filesize

    4KB

  • memory/4332-12-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4332-13-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB

  • memory/4332-14-0x0000000074F40000-0x00000000754F1000-memory.dmp

    Filesize

    5.7MB