Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:25

General

  • Target

    3ca3e4676bac76c4f7eaf0ab169b8af1.exe

  • Size

    78KB

  • MD5

    3ca3e4676bac76c4f7eaf0ab169b8af1

  • SHA1

    3873da68bc51d374243468d08e73058674ea0a02

  • SHA256

    572c49454d971b5cebc708b888e42970a4f954d97cdd8cd237a5ce4b281c60a7

  • SHA512

    2f34a5d1affdada1686408f5f6ac748fd688215a2a12acf897f06af177ad103dbae344102b271b572a5e51ec11b68d97b7d2fa184244ce67d5ea8430f85f1e4e

  • SSDEEP

    1536:bCHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN9/t1+S:bCHFq3Ln7N041QqhgN9/Z

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ca3e4676bac76c4f7eaf0ab169b8af1.exe
    "C:\Users\Admin\AppData\Local\Temp\3ca3e4676bac76c4f7eaf0ab169b8af1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zkkawqep.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8788.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8787.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2072
    • C:\Users\Admin\AppData\Local\Temp\tmp86DC.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp86DC.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3ca3e4676bac76c4f7eaf0ab169b8af1.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES8788.tmp

    Filesize

    1KB

    MD5

    83be2aae8b171299f79293dabf0fdf35

    SHA1

    38cf9be53f425942ef3b485446f9a875167476fc

    SHA256

    71781ea44ccf9c492fdf0ec6b8c895ba52540e91a24daa775d15ddc04e2b7fe4

    SHA512

    1aaf7db1ce856c01fb328ec8070f8f75d90b97268f0d7066b8d2052758f1c5590503216acf4680e7ceb88c403f0bdd1cd4aaa3309f4a43179f7badfe8229a481

  • C:\Users\Admin\AppData\Local\Temp\tmp86DC.tmp.exe

    Filesize

    78KB

    MD5

    b41f0fad9ab5115c05549ead2a2ed685

    SHA1

    a20b332e9280d204a41bcdb465cdb1e69262d0fa

    SHA256

    4292f5a5a4e8503733ef3626545dc848b1b6cadca105f6cd1c4986507a013c15

    SHA512

    fe09962026f9523b7195efcc5bc9b11bab63c13052ab10d7d16e57f9d24ef96b6fab49d8f0cbc10616c76d7e7ac18541cd25f599c9005f1ffc736e076850bad8

  • C:\Users\Admin\AppData\Local\Temp\vbc8787.tmp

    Filesize

    660B

    MD5

    a1682afc9684670f50a39048dff20813

    SHA1

    400e7673d48903ea6edddb10066fc4a778590fd6

    SHA256

    7c6743991c72e827a8224751e2ff3502881277ea2c8de3a2f25cf5128957cc05

    SHA512

    611509077c5598477737f232649bf03146fd35f2d580fe93d2828f63bbd33a589540e0498d77f34e91c7fb07e2a2d2ccce765d3b5f2fc5c7c7c56dacda819502

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • C:\Users\Admin\AppData\Local\Temp\zkkawqep.0.vb

    Filesize

    15KB

    MD5

    e8db4e7461bbe85e77328af803322b1a

    SHA1

    7270e0a6e1fecf3430546b1e7d4a67cd4c249b1d

    SHA256

    9024bf5994f2cdb0b70ff059cd91ed01370465010a8a361e27ac3b9373adfbd8

    SHA512

    c95a4739a2da651062a1b75706fbbec14b838ce07a0815bed7c13075a3bc90d0b06477a9adeb52a218aa139a909bc0133c4487f7354e2893c427ec5429d000f1

  • C:\Users\Admin\AppData\Local\Temp\zkkawqep.cmdline

    Filesize

    266B

    MD5

    b4a476895dd88e9f9cc10a936611a2dd

    SHA1

    4477f311c71162e770e3b22a9d451a39b6d22112

    SHA256

    1bd40432b6243cf22be7c711e5d21cb49b5b0cbec86e8b0e32773627a63f5913

    SHA512

    b6f35eff2dbed544b349de73687ff60b0dd1b6d2bb671ac5f2a469ddd62aab6c4cdf24ca400f6f5b40efc993cdef465b39dc6ca5ad8af8b51fa4ed497ebf40bb

  • memory/2160-0-0x0000000074D91000-0x0000000074D92000-memory.dmp

    Filesize

    4KB

  • memory/2160-1-0x0000000074D90000-0x000000007533B000-memory.dmp

    Filesize

    5.7MB

  • memory/2160-2-0x0000000074D90000-0x000000007533B000-memory.dmp

    Filesize

    5.7MB

  • memory/2160-24-0x0000000074D90000-0x000000007533B000-memory.dmp

    Filesize

    5.7MB

  • memory/3036-8-0x0000000074D90000-0x000000007533B000-memory.dmp

    Filesize

    5.7MB

  • memory/3036-18-0x0000000074D90000-0x000000007533B000-memory.dmp

    Filesize

    5.7MB