Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    12/12/2024, 02:03

General

  • Target

    2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe

  • Size

    22.7MB

  • MD5

    0178d22ec86dd92c1cd8e0ba2ac223e5

  • SHA1

    30025465a07d50a21b8dda66b4591f545c35989d

  • SHA256

    b52c47e114f8e8523dfb634146a4bf8bb54d639d3e733d7b3afe7cfb623208cc

  • SHA512

    0c2075ac382e3c31eaac831e6225bc5cf96e4971d0779e636215fce16b2acecd6d6fb7722877e2139190331e6c4443c92a16bf51816748a6a1e322263dd9c9bf

  • SSDEEP

    196608:49uXVejN2DaVCjRgo5wwDScTLKdJ4R2zJXTO0yVejN2DaVCjRgo5wwDScTLKdJ4I:49pWH5/+dBJXTzrWH5/+dBJXTz

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.1.26:443

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Loads dropped DLL 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 13 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-12_0178d22ec86dd92c1cd8e0ba2ac223e5_avoslocker_hijackloader_luca-stealer_magniber.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\SysWOW64\msiexec.exe
      C:\Windows\system32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\vnc64.msi ProductLanguage=1033
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2392
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Loads dropped DLL
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 56B6D0C903915EBBA005B685DCA781C0 M Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:640
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2512
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000060" "00000000000003EC"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f7737f4.rbs

    Filesize

    1.0MB

    MD5

    49dbe1f77751eb316abb70c393ca9e73

    SHA1

    724b5ff6cebd907d6552d56837b30ae1f7144ad6

    SHA256

    53ee8a3678f5447cacc0913477ed1d97fc65bcc752656e5444217c1ef1987dd5

    SHA512

    e20d63f38c164c79f28170ecb87b66e7cf7252f4e78a5af82a9b907306d7845c9f0acd6504040dc5e2374e5ae85d1f58b5e7396d18e02202677f0eb0a8eff70f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    471B

    MD5

    4a9aa6a614556e086a26fd3799e56ddd

    SHA1

    f20b660dfaba446060f0c074a511cb931adc1129

    SHA256

    1f26a246511a771e468f21ebf16ebc65771824106b0cdf4ac4d7686a0e33f9ec

    SHA512

    417fe3d13064b688bc432a363bb8ffcbb5236b0481eb804889ffe836f3796d5e96634f1685c4f36588c067a05cb15b50795bf6363f1ded5c23533faecb15ad47

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513

    Filesize

    727B

    MD5

    2720763d3d6e1af588241a850d29db71

    SHA1

    5304cfecb54632e1824150f2db0d69ff1fa5a686

    SHA256

    aaf83b6a0722f145f3b5a85052e44b6c59689ffb03189d68a44b24cb0b5fd364

    SHA512

    64d2b84bc11e36de9aec359523e628636874e8c5ebe76f46134dd01ddd8bfa1c1666af0fae865268c464b4a83eba2ecc4c93f386cd101f988be07593bd014cf0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    727B

    MD5

    144166bcdd73de6bc88826b56a505cf7

    SHA1

    ec02bf36ee81da1c0b9092337a054956480ea26a

    SHA256

    d7ed6d87057832f9a9d0476cc4f287cfd161453d978088bac3504428709a7523

    SHA512

    f56bbc0ed83c96aac239356e0664ac511b7c4c651017843f9fadf189e9a5dc0bc9f0eba3cb95179383d69c076feb966c2fd9bf00ef976e2c925ae8cbada4e463

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

    Filesize

    400B

    MD5

    ffb9a2f580e5c34f741ba5600a973ec3

    SHA1

    9315f3f9935a0748c0eb6ff2117a53a9bd38e8fb

    SHA256

    e054c70021988a6cdec21bec86d77e47f06217a1a760ae53b7e325636371f53a

    SHA512

    58df2adeeb79b26505ff486dbd0d0e9fec6ecdb106d1f35d2e0279639ddf521811269c900f55920e627db9e9ab375c21aa381b036c25c2f38e8f35201448abad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F59623AEE3E6048CCD92ADA564422513

    Filesize

    408B

    MD5

    be57ecd0e6750798a027d76227791aa2

    SHA1

    d1cc2e3a4150dbc607d8bc5a7052ffcb64cdfddc

    SHA256

    ec8fd8552a39ca841115da7c27ad44cdd175556f21954ef95dfed026f25ee8c3

    SHA512

    bb1d780b74c04707c2eda61f6baa808b0d6ef0360f33507e47805075d5be99b9ddf0735ef9297dc10dcd86d5b652f2b7680a208a052535bf00f16864baab2cb0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

    Filesize

    412B

    MD5

    1a7fc50e0efda8620b5da9f41e160ba8

    SHA1

    3c0af634377b7cf199583e8dfaa3a20a4ecc39c4

    SHA256

    19125a62ddcdec9a336081395a66a417366fe3bba6ab023f66c132668f46d676

    SHA512

    bd8713225b31877ef62fedf1297ad24d4ae130d4a88b08ab78424ef1953d9d1e4d3646060431052fe534bb4c079b86b0c2ced0c646c96cfcbca3d81a6798e65c

  • C:\Users\Admin\AppData\Local\Temp\CabB415.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarB58E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\vnc64.msi

    Filesize

    5.6MB

    MD5

    5b24d1c6b28984bf3a307a217ae862b4

    SHA1

    4db2cb295343977d1c4b1a6f0c8890f47aab6271

    SHA256

    14c5a337888158e635ea9d5c6d608ad5e9fb6af0b5f125d20b38bb03e26ffd6b

    SHA512

    1e30c593a2542099372dd0e6dc14f25a4cfeb5d4aa95a3981da4def8942db9ed0603e64f9c5d8040ca21f3894c7fe705fff62bb47dfe6ff9ccb7a84516f014a8

  • C:\Windows\Installer\MSI3D43.tmp

    Filesize

    1.0MB

    MD5

    55d3dcd4008adcfef3e0cb44fb0f229b

    SHA1

    6f828fa6e759b1cae266954670448f8bc6c6316f

    SHA256

    96fad74bb3630a31b8793887f394ba45a251b4b292c37225db05f47785c7dcf7

    SHA512

    19fc3c4b83392734a30019e08408ba4865ba483fd2ab701c630aad67b70bc9d0785aa70f737692b1955357a9a7e702ad868e48f6d6f03e5639126481f3319634

  • \Program Files\RealVNC\VNC Viewer\vncviewer.exe

    Filesize

    11.3MB

    MD5

    13074501a8d7b61da2845bb4c509ba56

    SHA1

    c2faf654ba721d435fc44eebd5f61f5f119f3f9f

    SHA256

    6b6287b1e4a93b01124f7d091aec49b3d286b7aff625b3520b531fee3c6a324a

    SHA512

    95556fae5921523c5122edd73dcdb54aebc4289d57cae99cc67984a51c8ccb8198fdfb58c5fac31a65e13b5247e658770dcb6aceffc4a4c1458260d294b37895

  • memory/2604-0-0x0000000000400000-0x0000000001AB5AEC-memory.dmp

    Filesize

    22.7MB

  • memory/2604-84-0x0000000000400000-0x0000000001AB5AEC-memory.dmp

    Filesize

    22.7MB