Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09/06/2023, 14:03
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
8.8MB
-
MD5
9068a3d8251716410e5baa7c95db8755
-
SHA1
d92d985a74a27591718ea4fe50eee965823b0ea1
-
SHA256
64b2695097ec03c0c7538389dc46641e0db93cf91f8cc6055dcc8d76637e28e5
-
SHA512
5d56f33340b2ee7bbb39be857d5d4c51e1e0baa460c3941406ec67b473e7556d81fd79ea0730db8abe267a74361a74c84945a8ff6ab891bab20084144167dc80
-
SSDEEP
196608:rZt3tP7+if+Bvcm2JCQ5+PiTwq+iB/3ZvTXjcLcB2AS9YeBtOIcIvNTB:hlf+vloZA23ZvTog2FpyI
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral1/memory/1196-58-0x0000000010000000-0x0000000010020000-memory.dmp fatalrat behavioral1/memory/1196-62-0x0000000003FA0000-0x0000000003FBE000-memory.dmp fatalrat -
Deletes itself 1 IoCs
pid Process 1356 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe 1196 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1196 tmp.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1196 tmp.exe 1196 tmp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2044 1196 tmp.exe 27 PID 1196 wrote to memory of 2044 1196 tmp.exe 27 PID 1196 wrote to memory of 2044 1196 tmp.exe 27 PID 1196 wrote to memory of 2044 1196 tmp.exe 27 PID 1196 wrote to memory of 1356 1196 tmp.exe 30 PID 1196 wrote to memory of 1356 1196 tmp.exe 30 PID 1196 wrote to memory of 1356 1196 tmp.exe 30 PID 1196 wrote to memory of 1356 1196 tmp.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵PID:2044
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Deletes itself
PID:1356
-