Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2025, 01:00

General

  • Target

    Monotone-HWID-Spoofer-main/Commands/Hidden/Block.exe

  • Size

    119KB

  • MD5

    5782b8d469bbc9045ebd2316c2aefbd5

  • SHA1

    f679adea19ac0e88a50cfefb88825a086102f77d

  • SHA256

    dfd08e1d7a34bae6836b3915b45b8637b85cdc998198c5bf148fba5e96f15c21

  • SHA512

    e57ed92d3c916b89e5f830fb52a63b330e404ea91a7cc0e0b0e8cfb03f9bea7252f1fa8fcf3950ae2bd404dcd189eeac27bcdc1cf529acd8ebde0bc5f457d023

  • SSDEEP

    3072:u2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXnI:PbJhs7QW69hd1MMdxPe9N9uA0hu9TBKI

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Monotone-HWID-Spoofer-main\Commands\Hidden\Block.exe
    "C:\Users\Admin\AppData\Local\Temp\Monotone-HWID-Spoofer-main\Commands\Hidden\Block.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CEF8.tmp\CEF9.tmp\CEFA.bat C:\Users\Admin\AppData\Local\Temp\Monotone-HWID-Spoofer-main\Commands\Hidden\Block.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\system32\PING.EXE
        ping localhost
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3648
      • C:\Windows\system32\tasklist.exe
        tasklist /NH /FI "imagename eq Monotone.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3952
      • C:\Windows\system32\find.exe
        find /i "Monotone.exe"
        3⤵
          PID:1488

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\CEF8.tmp\CEF9.tmp\CEFA.bat

      Filesize

      234B

      MD5

      6bf25f359aa5fbd7e1dd035df781227c

      SHA1

      f13a903548ba59fe28e1b6edca19bab5083b806d

      SHA256

      db9b3975c87afa294cafdd40cac28ed305d39c6215aa170dc3cf6005e86f9e46

      SHA512

      ea91c96d2d8a5c28e4d81af7ac0175b9dcd6757e97925609ac23ce4e1738698c10ffd05ce446610330d6f66b78f01336df1a997d1535ab8d0925eef2de9ae314