Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    50s
  • max time network
    35s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    13/12/2024, 07:23

General

  • Target

    tni.exe

  • Size

    18.0MB

  • MD5

    eae08904c3970d0159cd833b4d19c1ef

  • SHA1

    2013978ecacbe7c12a296bd8278a8691e4850b3b

  • SHA256

    2c4b6c01bdaeb1a5b18252fb2d34b5c9499c0bfa7465e714563f6a89d34cf235

  • SHA512

    01ed22ab70c69728c74bb07eacc35ffa8dbd01d647f37c3bceccea7247ba78cc3522ccfc943a69a2194b7c29b0452ce74f0ca669ed08b6d395f5007830145194

  • SSDEEP

    393216:wdb3FiCHHMEeBZIGlRq2IzD70XN0il34Tvy06AoVMnvz:MbVrs7TlNI37GfqTq0ro

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Banload family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tni.exe
    "C:\Users\Admin\AppData\Local\Temp\tni.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:388
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:4380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Documents\TNI storage\.connections.ini

      Filesize

      160B

      MD5

      651ab69f2413fcae765a1acd0d023539

      SHA1

      6a54fde9bd07bc2971d0927a2f05aa996554de29

      SHA256

      46641882899543870a0cd00c1daa1fa784013b8b83735b5935728604464bb11c

      SHA512

      8647c7c4f17d5bdb6360b0953424273b3797f49e05bb5813a55288e262c6d763a97bb270cee5a6f5fef741b37bc19f5f6c04083d99eab7fde63068c49b8db7fa

    • memory/388-24-0x0000000006270000-0x0000000006271000-memory.dmp

      Filesize

      4KB

    • memory/388-25-0x00000000062E0000-0x00000000064C7000-memory.dmp

      Filesize

      1.9MB

    • memory/388-14-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-16-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-17-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-18-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-22-0x00000000062E0000-0x00000000064C7000-memory.dmp

      Filesize

      1.9MB

    • memory/388-19-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-20-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-26-0x00000000062E0000-0x00000000064C7000-memory.dmp

      Filesize

      1.9MB

    • memory/388-12-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-21-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-0-0x00000000062E0000-0x00000000064C7000-memory.dmp

      Filesize

      1.9MB

    • memory/388-27-0x0000000006790000-0x0000000006791000-memory.dmp

      Filesize

      4KB

    • memory/388-34-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-35-0x0000000006270000-0x0000000006271000-memory.dmp

      Filesize

      4KB

    • memory/388-36-0x0000000006790000-0x0000000006791000-memory.dmp

      Filesize

      4KB

    • memory/388-38-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-10-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-58-0x00000000062E0000-0x00000000064C7000-memory.dmp

      Filesize

      1.9MB

    • memory/388-56-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB

    • memory/388-59-0x0000000000400000-0x0000000004063000-memory.dmp

      Filesize

      60.4MB