Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2024, 20:23

General

  • Target

    49526e292bc356673520262072d7be0e53c134ab16db381f2c58992f081e6ae6N.exe

  • Size

    78KB

  • MD5

    c67f959690925a70d625e554abfc98b0

  • SHA1

    dc6907ae7361723bdb30c2a595a04705aaaa8216

  • SHA256

    49526e292bc356673520262072d7be0e53c134ab16db381f2c58992f081e6ae6

  • SHA512

    4b396decb38bb184d1fe75d07187f32e3960d2b7efb2ec2fab95d3571caeeb1d580373629d3fdff85e40616916514b24d7c69498a0bb5cd151ff5a06e62a3693

  • SSDEEP

    1536:/uHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQteqT9/I12k:/uHa3Ln7N041QqhgeqT9/a

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49526e292bc356673520262072d7be0e53c134ab16db381f2c58992f081e6ae6N.exe
    "C:\Users\Admin\AppData\Local\Temp\49526e292bc356673520262072d7be0e53c134ab16db381f2c58992f081e6ae6N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fqojdqbr.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81F1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE45464BA9BE049AE9792496978E88A20.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3916
    • C:\Users\Admin\AppData\Local\Temp\tmp802C.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp802C.tmp.exe" C:\Users\Admin\AppData\Local\Temp\49526e292bc356673520262072d7be0e53c134ab16db381f2c58992f081e6ae6N.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES81F1.tmp

    Filesize

    1KB

    MD5

    62c437912ca5f9a9206b3a2b9cdb6aa4

    SHA1

    712567b7eba3d8904056fca80c712934127cd888

    SHA256

    f7a292482fa91600bfa39d08e81034c046a3463121f204b9f4d49457318d4e33

    SHA512

    c3156c5c1ea9a628b3c9d43527ebb9f2168a873f617d4bc9d0377a41bb42a3afc56e02d03982ee7a24a30cf02b15c402ddb47608a17131b8c9675a19a52744a0

  • C:\Users\Admin\AppData\Local\Temp\fqojdqbr.0.vb

    Filesize

    15KB

    MD5

    1e05468d1beee0e447a4b49b3550a06e

    SHA1

    a519830d29f9323dfc869eb9c06e90c38d4d7f5a

    SHA256

    ec37f17bc8f35b118235d93603703a81b83ab90bc2619501b1c6c878b07889c8

    SHA512

    b7bdbc36a7ff672c6bc3f243011509fde3689247e406902c6302f85b95d6481925b85656d87667dc1e7b0b767a7e2a68012c5dc87681faed8e2b2440d73d5e30

  • C:\Users\Admin\AppData\Local\Temp\fqojdqbr.cmdline

    Filesize

    266B

    MD5

    58d9dfff841d9e7581d65c60e70b48c3

    SHA1

    447f1d2f4caf5bf2b4813d175325a6f5252a38da

    SHA256

    0200375a5f0a67db4faca3599df373d031c93ec18c766e5d9351aa44e36a1fbd

    SHA512

    a4ba366c771596b182b548522c25b0e3b69f2d4176593d678d4dc2052367091465017da700eb96cf6102d2c9e5f92533a5b5fd244f7cd8bf871fb7947acab296

  • C:\Users\Admin\AppData\Local\Temp\tmp802C.tmp.exe

    Filesize

    78KB

    MD5

    f5d304788674fccccfb4cdec1b148890

    SHA1

    078eae6e7e101a7aa1ca58863cc186cef9a59331

    SHA256

    457aa7a80f3cc5a9a099766cb152d17b865c7f239bfae17864c5acccdfb69849

    SHA512

    42ed8f24cb3439d94f15c58d85b5aab908f78306a8bc75572ac76d32b1dc735d047a917a3460879cc6aab45b9ee087e6c6f151ef3cec27c49c6e2697772c9d84

  • C:\Users\Admin\AppData\Local\Temp\vbcE45464BA9BE049AE9792496978E88A20.TMP

    Filesize

    660B

    MD5

    4ee495d6d49b0ca1e237c3dde33e9e14

    SHA1

    7e39e04f9dfeb5ff420f4e354361a8614c7b3060

    SHA256

    bff20bfca03c9ddd65440b09a13d8f6ccb7b25ce6d0203c4178be3c4de298b8c

    SHA512

    69e01d594573251b36930075f39e3833c02ed6567250946f81ac7f47d31cb9bf7521eb3c868ecc6a4149db55498191ddbefa8985d31bee83c2155148a02e8385

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • memory/2776-23-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-28-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-27-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-26-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-24-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/3552-9-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/3552-18-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/3700-22-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/3700-1-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/3700-2-0x0000000074DF0000-0x00000000753A1000-memory.dmp

    Filesize

    5.7MB

  • memory/3700-0-0x0000000074DF2000-0x0000000074DF3000-memory.dmp

    Filesize

    4KB