Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
03/08/2023, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
Resource
win10v2004-20230703-en
General
-
Target
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe
-
Size
101KB
-
MD5
c24b15ddcf5f38b957e29cbb770513b6
-
SHA1
776d4d0ebaaa3ad42ca0bea26e55efe032d64922
-
SHA256
ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c
-
SHA512
7dc315b2981d7b9bb61967541119c76a6ffec913c20093a2a0f94dcb52d7b49f087afe406549254ab969ec451bfa66158ce38ce16b33076d8fe0aba3d447b6b8
-
SSDEEP
1536:gt1DlqVQsb7O+qgC23pG8XIXNe6Mv5io63RG8jpkcF6YPxMsJPxj:ggrO+qh2pXye6MBN63RpjpZFBxMExj
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
resource yara_rule behavioral1/memory/2684-72-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral1/memory/2684-81-0x0000000000400000-0x00000000005A4000-memory.dmp fatalrat -
Blocklisted process makes network request 1 IoCs
flow pid Process 5 2684 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2936 Vwxyab.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cmd.exe cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2244 set thread context of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Vwxyab.exe cmd.exe File opened for modification C:\Windows\Vwxyab.exe cmd.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2052 2244 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe 2684 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2684 cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2684 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 31 PID 2244 wrote to memory of 2052 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 32 PID 2244 wrote to memory of 2052 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 32 PID 2244 wrote to memory of 2052 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 32 PID 2244 wrote to memory of 2052 2244 ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"C:\Users\Admin\AppData\Local\Temp\ab6a39b8f6567f05c7f1929de047a9a5bd0dc4243e0c32b11c38856d9f5b991c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 8082⤵
- Program crash
PID:2052
-
-
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe1⤵
- Executes dropped EXE
PID:2936
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1