Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30/01/2022, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe
Resource
win10-en-20211208
General
-
Target
6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe
-
Size
1.1MB
-
MD5
645d2fdc3d638b6e9eeeda9bf7bd332b
-
SHA1
380150520be6c22ec302d0f89ac1f312a7b2dfa6
-
SHA256
6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db
-
SHA512
a1ac538eaf42f522f05c04833d6bdb736489f6c702f5bb74435fcaa5b80241ad9e69a3088e9b16a665d1140cc4d5ba0f8326a6092147b0be93cb9cb705297539
Malware Config
Signatures
-
CrimsonRAT Main Payload 2 IoCs
resource yara_rule behavioral1/files/0x0006000000012634-58.dat family_crimsonrat behavioral1/files/0x0006000000012634-59.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Executes dropped EXE 1 IoCs
pid Process 1804 ntharprmes.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\PROGRA~3\Rharbwd\ntharprmes.exe 6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe File created C:\PROGRA~3\Rharbwd\ntharprmes.exe 6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 536 wrote to memory of 1804 536 6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe 29 PID 536 wrote to memory of 1804 536 6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe 29 PID 536 wrote to memory of 1804 536 6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe"C:\Users\Admin\AppData\Local\Temp\6c917faa1a5ea5ae74525ace0c39c4a9208cb48f64372b8cd97c2e6e96a957db.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:536 -
C:\ProgramData\Rharbwd\ntharprmes.exe"C:\ProgramData\Rharbwd\ntharprmes.exe"2⤵
- Executes dropped EXE
PID:1804
-