Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7androrat-m...y/.xml
windows7-x64
1androrat-m...y/.xml
windows10-2004-x64
1androrat-m...y/.xml
windows7-x64
1androrat-m...y/.xml
windows10-2004-x64
1androrat-m...at.apk
android-9-x86
androrat-m...at.apk
android-10-x64
androrat-m...at.apk
android-11-x64
androrat-m...at.apk
android-9-x86
androrat-m...at.apk
android-10-x64
androrat-m...at.apk
android-11-x64
androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
3androrat-m....class
windows7-x64
3androrat-m....class
windows10-2004-x64
Analysis
-
max time kernel
118s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
androrat-master/Experiment/AndroratActivity/.xml
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
androrat-master/Experiment/AndroratActivity/.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
androrat-master/Experiment/AndroratActivity/.xml
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
androrat-master/Experiment/AndroratActivity/.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
androrat-master/Experiment/AndroratActivity/bin/ActivityAndrorat.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral6
Sample
androrat-master/Experiment/AndroratActivity/bin/ActivityAndrorat.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral7
Sample
androrat-master/Experiment/AndroratActivity/bin/ActivityAndrorat.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral8
Sample
androrat-master/Experiment/AndroratActivity/bin/Androrat.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral9
Sample
androrat-master/Experiment/AndroratActivity/bin/Androrat.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral10
Sample
androrat-master/Experiment/AndroratActivity/bin/Androrat.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral11
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/AdvancedInformationPacket.class
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/AdvancedInformationPacket.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CallLogPacket.class
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CallLogPacket.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CallPacket.class
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CallPacket.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CallStatusPacket.class
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CallStatusPacket.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CommandPacket.class
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/CommandPacket.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/ContactsPacket.class
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/ContactsPacket.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/FilePacket.class
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/FilePacket.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/FileTreePacket.class
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/FileTreePacket.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/GPSPacket.class
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/GPSPacket.class
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/LogPacket.class
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/LogPacket.class
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/Packet.class
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
androrat-master/Experiment/AndroratActivity/bin/classes/Packet/Packet.class
Resource
win10v2004-20221111-en
General
-
Target
androrat-master/Experiment/AndroratActivity/.xml
-
Size
1KB
-
MD5
c72f7ad78171afbcd8999b833df8ae2d
-
SHA1
d5470471fe9ec3e5262fec817d43778d5c74ce8f
-
SHA256
7e5653728cfc54cb8768571f4def48d1387bfd9da2a321df02581c0961ce658b
-
SHA512
036234a6a0c8f56be5edc92bdfdc91529c99040e6b7f0047e15f4a337783637da709af126d0f435a516f0c8783775aef43464748c7412ec72848f8b8a2ab4889
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097e4f50fd5775a4f8c154c771ec6c3dd000000000200000000001066000000010000200000008cdf9c0c82cdd96521748cb033c94d4d9162fe8ec10273897046e3c439930f07000000000e8000000002000020000000a695b46d221eace9e513d09eea46fa08a99bcd5167a8d2fce88e1119ffbc5fb02000000080b865b3e97f10f58a3a11f979d4e0ef97cfb57377fc599fab0b95ca03977d9d400000007cc8e9db2c26856b4724f739646caba3efb97ba1f67821e69afef0bbbcff3603ecff626f7bed994c502ac92f8df28e2f49d90fcf36854661346cc6317679f89f IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a048e1a08dffd801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376008622" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C867D011-6B80-11ED-A50E-C6457FCBF3CF} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000097e4f50fd5775a4f8c154c771ec6c3dd0000000002000000000010660000000100002000000043a6af23edd339cb6353c1f0293fd14b11c98edc2e7ffee04b167c4703023656000000000e8000000002000020000000d787d30ae8032cb191a5e7076af2b73d5edf362836df57c9f657e299b118ea3090000000ab603232c5fe64158b52120c250c192aceb88d931c5b56024693bd8756790e5c972bdbf548ad599650f5a5f756eca5611b852c8e8736fb85240d321d42d6dd80adb5495338518a9e31971707eaf3e288df0eb1745a109800ef2bc4b19ac47df47964c352a206e233774b26cd371a1fda1ba64c1ef105350c4507d0962f5a0ae8b48e60561381fb6683fdff4e0e41fa4640000000b8e3fb0282b32030dee9a834b447487cbccae4fdeeab8a802b4a6b5127f577c53dad7b2dec0728e9d80100a35176e4891631422cb29d4c94b24fc55964396ee7 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1332 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 908 wrote to memory of 1528 908 MSOXMLED.EXE 28 PID 908 wrote to memory of 1528 908 MSOXMLED.EXE 28 PID 908 wrote to memory of 1528 908 MSOXMLED.EXE 28 PID 908 wrote to memory of 1528 908 MSOXMLED.EXE 28 PID 1528 wrote to memory of 1332 1528 iexplore.exe 29 PID 1528 wrote to memory of 1332 1528 iexplore.exe 29 PID 1528 wrote to memory of 1332 1528 iexplore.exe 29 PID 1528 wrote to memory of 1332 1528 iexplore.exe 29 PID 1332 wrote to memory of 1292 1332 IEXPLORE.EXE 30 PID 1332 wrote to memory of 1292 1332 IEXPLORE.EXE 30 PID 1332 wrote to memory of 1292 1332 IEXPLORE.EXE 30 PID 1332 wrote to memory of 1292 1332 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\androrat-master\Experiment\AndroratActivity\.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1332 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD567d4f2ac0e76399be5197c169f361a32
SHA1b9069c5978751786972148b7d2df64959d689970
SHA25696857293745b7fe6300bba3eaa385855ea7d97cb5c52fa3671f3910303832178
SHA512f43b6be90009e75bd62b3949b51350592b5a6ed4d3851c9673a5e7847ae729b4aa86e030e2d66576903c5c38fff76a7b066ec3960e4df17e2b92a8bb653e0986