Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2022, 03:43

General

  • Target

    7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe

  • Size

    201KB

  • MD5

    23fa0fef80fa2e8ba41ae5546a27c13c

  • SHA1

    f5e41fa9f767247df59fb40b1ac423fb700f8f55

  • SHA256

    7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde

  • SHA512

    64719f22b06a5ad498eedb605051454e123607908feaf20af6a4042ddc1dc3ae523973e1f5a1c3ca27443d670f46ca66aaf51b72756f1c902109e459dc4caea5

  • SSDEEP

    6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFE:HqEjk7l7FE

Malware Config

Signatures

  • ParallaxRat

    ParallaxRat is a multipurpose RAT written in MASM.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe
    "C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe
      "C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DLXBY.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:320
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f
          4⤵
          • Adds Run key to start application
          PID:1396
      • C:\Users\Admin\AppData\Roaming\Security\security.exe
        "C:\Users\Admin\AppData\Roaming\Security\security.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:828
        • C:\Users\Admin\AppData\Roaming\Security\security.exe
          "C:\Users\Admin\AppData\Roaming\Security\security.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:776
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
            PID:532

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DLXBY.bat

      Filesize

      147B

      MD5

      6f473a1ba53e043362047f72e20b34f4

      SHA1

      e8f121a589e1207ed950453376ee1d21b1223835

      SHA256

      5fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b

      SHA512

      b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818

    • C:\Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • C:\Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • C:\Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • \Users\Admin\AppData\Roaming\Security\security.exe

      Filesize

      201KB

      MD5

      2f3b8f5117b48b087c787499d38af996

      SHA1

      8bb4855a71ac345b726fc51424e39461c122f4cf

      SHA256

      2531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63

      SHA512

      2b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092

    • memory/532-119-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/532-118-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/532-132-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

      Filesize

      8KB

    • memory/532-129-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/532-127-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/532-126-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/532-123-0x0000000000400000-0x0000000000417000-memory.dmp

      Filesize

      92KB

    • memory/776-136-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/776-134-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/828-107-0x000000000064F000-0x0000000000661000-memory.dmp

      Filesize

      72KB

    • memory/1272-82-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1272-83-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1272-89-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1272-90-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1272-93-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1272-86-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1272-133-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1272-94-0x0000000076091000-0x0000000076093000-memory.dmp

      Filesize

      8KB

    • memory/1272-85-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB