Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
10/08/2023, 14:52
General
-
Target
Rat/Taskmg.exe
-
Size
2.0MB
-
MD5
a341b3a7990a811f0666bc0bedefb1dd
-
SHA1
647b053c5308b18b9202c6133b9c85c72b611760
-
SHA256
e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
-
SHA512
9860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
SSDEEP
49152:ZDPHyxkEDRNyxB69FeHkYij8jdphkygcsTuGhthoXsxZZ:ZD/mBDRNgyFeHkYiYpphkygcsTdthoX0
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rat\Taskmg.exe"C:\Users\Admin\AppData\Local\Temp\Rat\Taskmg.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Taskmg.exe"C:\Users\Admin\AppData\Local\Taskmg.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5a341b3a7990a811f0666bc0bedefb1dd
SHA1647b053c5308b18b9202c6133b9c85c72b611760
SHA256e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
SHA5129860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
Filesize
2.0MB
MD5a341b3a7990a811f0666bc0bedefb1dd
SHA1647b053c5308b18b9202c6133b9c85c72b611760
SHA256e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
SHA5129860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
Filesize
2.0MB
MD5a341b3a7990a811f0666bc0bedefb1dd
SHA1647b053c5308b18b9202c6133b9c85c72b611760
SHA256e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
SHA5129860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
Filesize
2.0MB
MD5a341b3a7990a811f0666bc0bedefb1dd
SHA1647b053c5308b18b9202c6133b9c85c72b611760
SHA256e09a30a80a3dfc9ec7357358a61227815ef7cc3ae2bd07f7587cec0dc52d8ab1
SHA5129860c5bc63097c3cbfd52eb26528750eb7925488218781c55cb4244fe4a426c5c05c193b16a5ac2624dd708cfe2265d84ef864e47a3fa1c9682139b5e011da73
-
Filesize
1024KB
-
Filesize
224KB
-
Filesize
168KB
-
Filesize
1024KB
-
Filesize
168KB
-
Filesize
224KB
-
Filesize
196KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB