Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15/10/2022, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
DOC_20221012_094045716_stripped.scr.exe
Resource
win7-20220812-en
General
-
Target
DOC_20221012_094045716_stripped.scr.exe
-
Size
105KB
-
MD5
640cc9bb769a9591c548cc63a15d15bf
-
SHA1
56e456d997ef4f2735b7ba48a3b0e4861327ed61
-
SHA256
ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
-
SHA512
9e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
-
SSDEEP
3072:M+rR+Y6VgvQdJK0vtNZg/V7S+O+dvvAun:M+BFI3vtNZNH+dv
Malware Config
Extracted
asyncrat
0.5.7B
Oct 11
donzola.duckdns.org:2000
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 11 IoCs
resource yara_rule behavioral1/memory/1972-61-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral1/memory/1972-59-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral1/memory/1972-62-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral1/memory/1972-63-0x000000000040C73E-mapping.dmp asyncrat behavioral1/memory/1972-65-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral1/memory/1972-67-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat behavioral1/memory/300-86-0x000000000040C73E-mapping.dmp asyncrat behavioral1/memory/300-90-0x0000000000090000-0x00000000000A6000-memory.dmp asyncrat behavioral1/memory/1952-108-0x000000000040C73E-mapping.dmp asyncrat behavioral1/memory/1952-118-0x0000000000090000-0x00000000000A6000-memory.dmp asyncrat behavioral1/memory/1952-115-0x0000000000090000-0x00000000000A6000-memory.dmp asyncrat -
Executes dropped EXE 4 IoCs
pid Process 1940 Windows Media Player Network Sharing Service.exe 300 Windows Media Player Network Sharing Service.exe 1604 Windows Media Player Network Sharing Service.exe 1952 Windows Media Player Network Sharing Service.exe -
Loads dropped DLL 2 IoCs
pid Process 1940 Windows Media Player Network Sharing Service.exe 1604 Windows Media Player Network Sharing Service.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1096 set thread context of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1940 set thread context of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1604 set thread context of 1952 1604 Windows Media Player Network Sharing Service.exe 47 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1088 schtasks.exe 740 schtasks.exe 740 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1972 1096 DOC_20221012_094045716_stripped.scr.exe 28 PID 1096 wrote to memory of 1888 1096 DOC_20221012_094045716_stripped.scr.exe 29 PID 1096 wrote to memory of 1888 1096 DOC_20221012_094045716_stripped.scr.exe 29 PID 1096 wrote to memory of 1888 1096 DOC_20221012_094045716_stripped.scr.exe 29 PID 1096 wrote to memory of 1888 1096 DOC_20221012_094045716_stripped.scr.exe 29 PID 1096 wrote to memory of 1716 1096 DOC_20221012_094045716_stripped.scr.exe 31 PID 1096 wrote to memory of 1716 1096 DOC_20221012_094045716_stripped.scr.exe 31 PID 1096 wrote to memory of 1716 1096 DOC_20221012_094045716_stripped.scr.exe 31 PID 1096 wrote to memory of 1716 1096 DOC_20221012_094045716_stripped.scr.exe 31 PID 1096 wrote to memory of 292 1096 DOC_20221012_094045716_stripped.scr.exe 32 PID 1096 wrote to memory of 292 1096 DOC_20221012_094045716_stripped.scr.exe 32 PID 1096 wrote to memory of 292 1096 DOC_20221012_094045716_stripped.scr.exe 32 PID 1096 wrote to memory of 292 1096 DOC_20221012_094045716_stripped.scr.exe 32 PID 1716 wrote to memory of 740 1716 cmd.exe 35 PID 1716 wrote to memory of 740 1716 cmd.exe 35 PID 1716 wrote to memory of 740 1716 cmd.exe 35 PID 1716 wrote to memory of 740 1716 cmd.exe 35 PID 1544 wrote to memory of 1940 1544 taskeng.exe 37 PID 1544 wrote to memory of 1940 1544 taskeng.exe 37 PID 1544 wrote to memory of 1940 1544 taskeng.exe 37 PID 1544 wrote to memory of 1940 1544 taskeng.exe 37 PID 1544 wrote to memory of 1940 1544 taskeng.exe 37 PID 1544 wrote to memory of 1940 1544 taskeng.exe 37 PID 1544 wrote to memory of 1940 1544 taskeng.exe 37 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 300 1940 Windows Media Player Network Sharing Service.exe 38 PID 1940 wrote to memory of 628 1940 Windows Media Player Network Sharing Service.exe 39 PID 1940 wrote to memory of 628 1940 Windows Media Player Network Sharing Service.exe 39 PID 1940 wrote to memory of 628 1940 Windows Media Player Network Sharing Service.exe 39 PID 1940 wrote to memory of 628 1940 Windows Media Player Network Sharing Service.exe 39 PID 1940 wrote to memory of 1676 1940 Windows Media Player Network Sharing Service.exe 40 PID 1940 wrote to memory of 1676 1940 Windows Media Player Network Sharing Service.exe 40 PID 1940 wrote to memory of 1676 1940 Windows Media Player Network Sharing Service.exe 40 PID 1940 wrote to memory of 1676 1940 Windows Media Player Network Sharing Service.exe 40 PID 1940 wrote to memory of 1720 1940 Windows Media Player Network Sharing Service.exe 41 PID 1940 wrote to memory of 1720 1940 Windows Media Player Network Sharing Service.exe 41 PID 1940 wrote to memory of 1720 1940 Windows Media Player Network Sharing Service.exe 41 PID 1940 wrote to memory of 1720 1940 Windows Media Player Network Sharing Service.exe 41 PID 1676 wrote to memory of 1088 1676 cmd.exe 45 PID 1676 wrote to memory of 1088 1676 cmd.exe 45 PID 1676 wrote to memory of 1088 1676 cmd.exe 45 PID 1676 wrote to memory of 1088 1676 cmd.exe 45 PID 1544 wrote to memory of 1604 1544 taskeng.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr.exe"C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr.exe"C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr.exe"2⤵PID:1972
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service"2⤵PID:1888
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f3⤵
- Creates scheduled task(s)
PID:740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\DOC_20221012_094045716_stripped.scr.exe" "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"2⤵PID:292
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {87881D81-3F94-4E6F-BEAA-86207FE8ED42} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"3⤵
- Executes dropped EXE
PID:300
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service"3⤵PID:628
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f4⤵
- Creates scheduled task(s)
PID:1088
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe" "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"3⤵PID:1720
-
-
-
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1604 -
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"3⤵
- Executes dropped EXE
PID:1952
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service"3⤵PID:620
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f3⤵PID:428
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe'" /f4⤵
- Creates scheduled task(s)
PID:740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe" "C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe"3⤵PID:1344
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize105KB
MD5640cc9bb769a9591c548cc63a15d15bf
SHA156e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA5129e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
-
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize105KB
MD5640cc9bb769a9591c548cc63a15d15bf
SHA156e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA5129e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
-
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize105KB
MD5640cc9bb769a9591c548cc63a15d15bf
SHA156e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA5129e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
-
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize105KB
MD5640cc9bb769a9591c548cc63a15d15bf
SHA156e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA5129e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
-
C:\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize105KB
MD5640cc9bb769a9591c548cc63a15d15bf
SHA156e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA5129e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
-
\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize105KB
MD5640cc9bb769a9591c548cc63a15d15bf
SHA156e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA5129e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06
-
\Users\Admin\AppData\Roaming\Windows Media Player Network Sharing Service\Windows Media Player Network Sharing Service.exe
Filesize105KB
MD5640cc9bb769a9591c548cc63a15d15bf
SHA156e456d997ef4f2735b7ba48a3b0e4861327ed61
SHA256ef1cddd57724a667599eb57a77aedde1f256853f54698a68a610c3d54f924f1e
SHA5129e05ca442fae59a54d25fced3a156cd7eb00ba4a0ec80e69468a06639b558ee34c6c6509815eb9a10e6f833d34d48832f073fa7c0f4075ee8da16283d0a58d06