Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:09

General

  • Target

    3834ae494af0fd48ecc667bea1ef47cf.exe

  • Size

    78KB

  • MD5

    3834ae494af0fd48ecc667bea1ef47cf

  • SHA1

    f9eaf46f7a2984ea27b86cfe0a8a22f5cf8f84ad

  • SHA256

    c791781a31dc589e586824324fd17b81091656130f2efceca554adddc668f8e0

  • SHA512

    eaec00e79da4238f13ba254fdd9dc1b19f660a0d09401c1deaa9fc17ac3bff4b2d0b711a54c6cdb460aa57141f32994072695e210cc57efa2b7a1bfe4da0a75c

  • SSDEEP

    1536:q5jScdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN6/9/S1R2:q5jSrn7N041Qqhg09/T

Malware Config

Signatures

  • MetamorpherRAT

    Metamorpherrat is a hacking tool that has been around for a while since 2013.

  • Metamorpherrat family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3834ae494af0fd48ecc667bea1ef47cf.exe
    "C:\Users\Admin\AppData\Local\Temp\3834ae494af0fd48ecc667bea1ef47cf.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mkijx6bs.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5956
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8165.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA430CE79E4A84A35B6CB2587EB0C1D5.TMP"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1140
    • C:\Users\Admin\AppData\Local\Temp\tmp7FEE.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp7FEE.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3834ae494af0fd48ecc667bea1ef47cf.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES8165.tmp

    Filesize

    1KB

    MD5

    87fd8eb87f7f7d3f26cde4c655ed162c

    SHA1

    ba772f1d8d1cd1ade902b3975a6c8afe2cf8de92

    SHA256

    8bfee56f89258438722936cce291a8ac365f3b80eea9f06496225911a5e0a888

    SHA512

    7803f4a4886065007d8ae6e3f7fbb5f30c31b03b54daa3232fa69b4a5321f8a0cb7a1a4ef18db092e87046f7ca84ee14a01812eec47a34666a87a43666bf8b94

  • C:\Users\Admin\AppData\Local\Temp\mkijx6bs.0.vb

    Filesize

    14KB

    MD5

    11bea0a9e5a0a422c0be030a7c8f9ed1

    SHA1

    0e982483cbb450b93fb829e0a05276ffb37cdafd

    SHA256

    355081c5bbfe3e3c4ff1c29d13a238b4359f1c5054db527db9703cbf6b2ac6bb

    SHA512

    3a06ea588b8a9542787781404bda02a714fb01e990ea43413bdb055796a654b623d96460c4cf5b3192770ae362fc97c91b4e892d09290cc4453f7d6328dbbf3e

  • C:\Users\Admin\AppData\Local\Temp\mkijx6bs.cmdline

    Filesize

    266B

    MD5

    8700b5916c2f91f7118eda872d08703c

    SHA1

    5ee85c22a056b5548470eeddab7299ea30fb3d9d

    SHA256

    c3612a0f441160c5704d5d2063a4c6d12a34100fea3f3d69c0c44756af32ee21

    SHA512

    9de16924c2fd51650a17b6d175cd1e43819dad178606deda6a5c0c22099bbc044b490840cadf64310bd426250211a33ca85ee96907376eea168090390d6714da

  • C:\Users\Admin\AppData\Local\Temp\tmp7FEE.tmp.exe

    Filesize

    78KB

    MD5

    136e5e53114f8ab0c4cf404eae02a73e

    SHA1

    895382f3c3de88029b49b7ccbeffe77dd061761f

    SHA256

    b6eea534a4477b862d7433d399556b88268fd8642b19e7a0fb1300a72e32a42b

    SHA512

    b46aa526605d79f807cae07d44f61c5e2f9d01cb1f213c5ab9c72f14d48f33de481fe6d2bd415de37aa980a8e3838299325caca984e686870debac45d18166f6

  • C:\Users\Admin\AppData\Local\Temp\vbcA430CE79E4A84A35B6CB2587EB0C1D5.TMP

    Filesize

    660B

    MD5

    a259936ae9b8336f351b09bc75f8d088

    SHA1

    c27e87e9c76b0b917a1f5ce80a879b50d79c8b84

    SHA256

    8cebf27414d3b3bd9a01932604ba2bf604727b3daf8c1b729588dae9f1ea2ea6

    SHA512

    581ceebfdfcaa84e7485a594344bbb143581aec53e24c8c5ade48600e3a0634325d368847376790d2d43d32ec9a3e49bdfdd2ebccbf79529903a55c1f4010a8f

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    aa4bdac8c4e0538ec2bb4b7574c94192

    SHA1

    ef76d834232b67b27ebd75708922adea97aeacce

    SHA256

    d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430

    SHA512

    0ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65

  • memory/2528-22-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/2528-1-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/2528-2-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/2528-0-0x0000000074AB2000-0x0000000074AB3000-memory.dmp

    Filesize

    4KB

  • memory/3520-23-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/3520-25-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/3520-24-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/3520-27-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/3520-28-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/3520-29-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/5956-9-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB

  • memory/5956-18-0x0000000074AB0000-0x0000000075061000-memory.dmp

    Filesize

    5.7MB