Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/07/2023, 02:52
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp.exe
-
Size
801KB
-
MD5
55bf28cbd852233ddf8de2f24dad5787
-
SHA1
98a8794770fc469bf03c0c9d2a49230146add536
-
SHA256
2dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
-
SHA512
339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
SSDEEP
12288:GMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9zl6MMAj:GnsJ39LyjbJkQFMhmC+6GD993
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
RunningRat payload 11 IoCs
resource yara_rule behavioral2/files/0x0007000000023078-138.dat family_runningrat behavioral2/files/0x0007000000023078-192.dat family_runningrat behavioral2/files/0x0007000000023078-197.dat family_runningrat behavioral2/files/0x0007000000023080-199.dat family_runningrat behavioral2/files/0x0007000000023080-263.dat family_runningrat behavioral2/files/0x0007000000023080-264.dat family_runningrat behavioral2/memory/3772-268-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral2/files/0x0006000000023083-328.dat family_runningrat behavioral2/files/0x0006000000023083-329.dat family_runningrat behavioral2/memory/4712-338-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral2/memory/4712-361-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat -
Sets DLL path for service in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remocte4\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\240668937.dll" ._cache_tmp.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remocte4\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\240670328.dll" ._cache_Synaptics.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation ._cache_tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation ._cache_Synaptics.exe -
Executes dropped EXE 4 IoCs
pid Process 2664 ._cache_tmp.exe 4712 Synaptics.exe 4816 ._cache_Synaptics.exe 2856 Remocte4.exe -
Loads dropped DLL 4 IoCs
pid Process 2664 ._cache_tmp.exe 796 svchost.exe 4816 ._cache_Synaptics.exe 2856 Remocte4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" tmp.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Remocte4.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remocte4.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Remocte4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Remocte4.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Remocte4.exe Key created \REGISTRY\USER\.DEFAULT\Software Remocte4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Remocte4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Remocte4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Remocte4.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ tmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2432 PING.EXE 1820 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2664 ._cache_tmp.exe 2664 ._cache_tmp.exe 4816 ._cache_Synaptics.exe 4816 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2664 ._cache_tmp.exe Token: SeIncBasePriorityPrivilege 4816 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2664 ._cache_tmp.exe 4816 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3772 wrote to memory of 2664 3772 tmp.exe 85 PID 3772 wrote to memory of 2664 3772 tmp.exe 85 PID 3772 wrote to memory of 2664 3772 tmp.exe 85 PID 3772 wrote to memory of 4712 3772 tmp.exe 87 PID 3772 wrote to memory of 4712 3772 tmp.exe 87 PID 3772 wrote to memory of 4712 3772 tmp.exe 87 PID 2664 wrote to memory of 3108 2664 ._cache_tmp.exe 89 PID 2664 wrote to memory of 3108 2664 ._cache_tmp.exe 89 PID 2664 wrote to memory of 3108 2664 ._cache_tmp.exe 89 PID 3108 wrote to memory of 2432 3108 cmd.exe 91 PID 3108 wrote to memory of 2432 3108 cmd.exe 91 PID 3108 wrote to memory of 2432 3108 cmd.exe 91 PID 4712 wrote to memory of 4816 4712 Synaptics.exe 92 PID 4712 wrote to memory of 4816 4712 Synaptics.exe 92 PID 4712 wrote to memory of 4816 4712 Synaptics.exe 92 PID 4816 wrote to memory of 3076 4816 ._cache_Synaptics.exe 93 PID 4816 wrote to memory of 3076 4816 ._cache_Synaptics.exe 93 PID 4816 wrote to memory of 3076 4816 ._cache_Synaptics.exe 93 PID 3076 wrote to memory of 1820 3076 cmd.exe 95 PID 3076 wrote to memory of 1820 3076 cmd.exe 95 PID 3076 wrote to memory of 1820 3076 cmd.exe 95 PID 796 wrote to memory of 2856 796 svchost.exe 99 PID 796 wrote to memory of 2856 796 svchost.exe 99 PID 796 wrote to memory of 2856 796 svchost.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"2⤵
- Sets DLL path for service in the registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 14⤵
- Runs ping.exe
PID:2432
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Sets DLL path for service in the registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 15⤵
- Runs ping.exe
PID:1820
-
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remocte4"1⤵PID:4448
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remocte4"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\Remocte4.exeC:\Windows\system32\Remocte4.exe "c:\users\admin\appdata\local\temp\240668937.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9