Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2025, 02:10
Static task
static1
Behavioral task
behavioral1
Sample
041b2aedd7ad9d758f0050d0e016b89c4f136081c1f9b442ffc24b3f7afbbf0c.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
041b2aedd7ad9d758f0050d0e016b89c4f136081c1f9b442ffc24b3f7afbbf0c.vbs
Resource
win10v2004-20250217-en
General
-
Target
041b2aedd7ad9d758f0050d0e016b89c4f136081c1f9b442ffc24b3f7afbbf0c.vbs
-
Size
15KB
-
MD5
bcb612e1b6c71a2a1abd92a00db83b7e
-
SHA1
7416472e00f07753fb801e6afad7462a848fa59b
-
SHA256
041b2aedd7ad9d758f0050d0e016b89c4f136081c1f9b442ffc24b3f7afbbf0c
-
SHA512
bd45e8daf9aa07dfbb0e0c728635c8cf7f7c8fd85eacc7f989153de8b6c01aed016632f304749a281e8501eadd469f8448e977bb4b69f2aa5498e5259ffa5d4d
-
SSDEEP
384:Kzo3hl0ageVAsThoswEOelN91UhtDnj6H+Dded:thHlFzwSf/2tzq+Red
Malware Config
Extracted
darkvision
acuweld.ddns.net
Signatures
-
DarkVision Rat
DarkVision Rat is a trojan written in C++.
-
Darkvision family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1884 created 3328 1884 x.exe 55 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5660 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Exception.vbs x.exe -
Executes dropped EXE 1 IoCs
pid Process 1884 x.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1884 set thread context of 5504 1884 x.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1884 x.exe 1884 x.exe 1884 x.exe 5660 powershell.exe 5660 powershell.exe 5660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1884 x.exe Token: SeDebugPrivilege 1884 x.exe Token: SeDebugPrivilege 5660 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3924 wrote to memory of 1884 3924 WScript.exe 85 PID 3924 wrote to memory of 1884 3924 WScript.exe 85 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 1884 wrote to memory of 5504 1884 x.exe 96 PID 5504 wrote to memory of 4860 5504 InstallUtil.exe 97 PID 5504 wrote to memory of 4860 5504 InstallUtil.exe 97 PID 4860 wrote to memory of 5660 4860 cmd.exe 100 PID 4860 wrote to memory of 5660 4860 cmd.exe 100
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3328
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\041b2aedd7ad9d758f0050d0e016b89c4f136081c1f9b442ffc24b3f7afbbf0c.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\explorers'3⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:\ProgramData\explorers'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5660
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
11KB
MD55550073f13ecf0e63b3244671b14c740
SHA11fefd4a07ca3c0bf4cd1fffd5ff8ee08c0375734
SHA256a7ce5366211d4f74eff0579d0b905bff4d71b237c796cc82ad623238502a942d
SHA512402fbd9950a75b9e4d29283625079d9f647e7fbea02bc4227ff7eb00669720c6bccd858aee6eb85fc5c5b2e744387d9da1051cbce5dd76ce6082f11a223ce136