Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/07/2023, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe
Resource
win10v2004-20230703-en
General
-
Target
6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe
-
Size
788KB
-
MD5
eda46f81835c5b2aab811dffede1712f
-
SHA1
bd2256102a1288e2b552f68078edc4bedb31d8c1
-
SHA256
6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad
-
SHA512
e3c85087de6743b9de201a72e725061583f62c4a1f22c50b321460a0dbe3863a6b42bd573b9a847eb5e355dadda023005692d2e09f49c46c855ecb5d7020684c
-
SSDEEP
24576:yZrvXgsPx2pUJAYFu2oF5/b5hOwyfonNGeUIiBs919sc6BI:CvXgKmUJAYFurFxjiBsn9slBI
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral1/memory/1808-60-0x0000000000670000-0x000000000068F000-memory.dmp fatalrat behavioral1/memory/1808-61-0x0000000010000000-0x0000000010020000-memory.dmp fatalrat -
Deletes itself 1 IoCs
pid Process 1680 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1680 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 29 PID 1808 wrote to memory of 1680 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 29 PID 1808 wrote to memory of 1680 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 29 PID 1808 wrote to memory of 1680 1808 6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe"C:\Users\Admin\AppData\Local\Temp\6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\6fdebd27218d820aab768426215e50628db26dacb9cf992ba9212581f18706ad.exe2⤵
- Deletes itself
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5ba64147912c84f30017e1b70ad640629
SHA1385be170b2ca3987a1899b8916083642958fbfd2
SHA2567b1be6f5defcf082846bdcaa1dc23f9d10b40ad97eac2d428e068b0e3687dc4a
SHA5123f7633d715d5dde98017dffc8af502bc37f74deb6e5013e8ab1cea36413b7e5abc4c2774994a5ac43637833ef9c83126c1e308965630533b0ea739d322333aef