Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
9Monotone-H...in.zip
windows10-2004-x64
10Monotone-H...ox.bat
windows10-2004-x64
1Monotone-H...on.bat
windows10-2004-x64
1Monotone-H...rs.exe
windows10-2004-x64
1Monotone-H...s2.exe
windows10-2004-x64
1Monotone-H...ew.cfg
windows10-2004-x64
3Monotone-H...ew.exe
windows10-2004-x64
3Monotone-H...ck.exe
windows10-2004-x64
7Monotone-H...te.vbs
windows10-2004-x64
1Monotone-H...ss.bat
windows10-2004-x64
5Monotone-H...er.sys
windows10-2004-x64
1Monotone-H...ut.exe
windows10-2004-x64
3Monotone-H...en.bat
windows10-2004-x64
1Monotone-H...ne.exe
windows10-2004-x64
10Monotone-H...DME.md
windows10-2004-x64
3Monotone-H...ox.exe
windows10-2004-x64
3Monotone-H...64.exe
windows10-2004-x64
1Monotone-H...st.txt
windows10-2004-x64
1Monotone-H...id.ps1
windows10-2004-x64
3Monotone-H...ac.txt
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
Monotone-HWID-Spoofer-main.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Monotone-HWID-Spoofer-main/Box.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Monotone-HWID-Spoofer-main/Button.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/Adapters.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/Adapters2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/AlternateStreamView.cfg
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/AlternateStreamView.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/Block.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/UnbanComplete.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/process.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Monotone-HWID-Spoofer-main/Commands/Hidden/spoofer.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Monotone-HWID-Spoofer-main/GetInput.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Monotone-HWID-Spoofer-main/Getlen.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Monotone-HWID-Spoofer-main/Monotone.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Monotone-HWID-Spoofer-main/README.md
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Monotone-HWID-Spoofer-main/batbox.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Monotone-HWID-Spoofer-main/colorecho-vc10-x86_64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Monotone-HWID-Spoofer-main/host.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Monotone-HWID-Spoofer-main/hwid.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
Monotone-HWID-Spoofer-main/mac.txt
Resource
win10v2004-20241007-en
General
-
Target
Monotone-HWID-Spoofer-main/Commands/Hidden/Block.exe
-
Size
119KB
-
MD5
5782b8d469bbc9045ebd2316c2aefbd5
-
SHA1
f679adea19ac0e88a50cfefb88825a086102f77d
-
SHA256
dfd08e1d7a34bae6836b3915b45b8637b85cdc998198c5bf148fba5e96f15c21
-
SHA512
e57ed92d3c916b89e5f830fb52a63b330e404ea91a7cc0e0b0e8cfb03f9bea7252f1fa8fcf3950ae2bd404dcd189eeac27bcdc1cf529acd8ebde0bc5f457d023
-
SSDEEP
3072:u2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXnI:PbJhs7QW69hd1MMdxPe9N9uA0hu9TBKI
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Block.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3952 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3648 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3648 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3952 tasklist.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2152 2988 Block.exe 83 PID 2988 wrote to memory of 2152 2988 Block.exe 83 PID 2152 wrote to memory of 3648 2152 cmd.exe 85 PID 2152 wrote to memory of 3648 2152 cmd.exe 85 PID 2152 wrote to memory of 3952 2152 cmd.exe 87 PID 2152 wrote to memory of 3952 2152 cmd.exe 87 PID 2152 wrote to memory of 1488 2152 cmd.exe 88 PID 2152 wrote to memory of 1488 2152 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Monotone-HWID-Spoofer-main\Commands\Hidden\Block.exe"C:\Users\Admin\AppData\Local\Temp\Monotone-HWID-Spoofer-main\Commands\Hidden\Block.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CEF8.tmp\CEF9.tmp\CEFA.bat C:\Users\Admin\AppData\Local\Temp\Monotone-HWID-Spoofer-main\Commands\Hidden\Block.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3648
-
-
C:\Windows\system32\tasklist.exetasklist /NH /FI "imagename eq Monotone.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\system32\find.exefind /i "Monotone.exe"3⤵PID:1488
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
234B
MD56bf25f359aa5fbd7e1dd035df781227c
SHA1f13a903548ba59fe28e1b6edca19bab5083b806d
SHA256db9b3975c87afa294cafdd40cac28ed305d39c6215aa170dc3cf6005e86f9e46
SHA512ea91c96d2d8a5c28e4d81af7ac0175b9dcd6757e97925609ac23ce4e1738698c10ffd05ce446610330d6f66b78f01336df1a997d1535ab8d0925eef2de9ae314