Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22/08/2023, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe
-
Size
508KB
-
MD5
748153a93ec63ecbbb5dbd4a4c57c34f
-
SHA1
41161e254b1112f02be8efc10be58dd2b284a013
-
SHA256
2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903
-
SHA512
af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe
-
SSDEEP
6144:gqRtk+feyFwSzkPDNGEfDVFG1wqBVb1w1s:Jtk+8ykLlpF6PVR9
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/2316-54-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 2528 Vwxyab.exe 3008 Vwxyab.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Vwxyab.exe 2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe File opened for modification C:\Windows\Vwxyab.exe 2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe File opened for modification C:\Windows\Vwxyab.exe Vwxyab.exe File created C:\Windows\Vwxyab.exe Vwxyab.exe -
Modifies data under HKEY_USERS 22 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Vwxyab Defghijk\InstallTime = "2023-08-22 23:35" Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Vwxyab Defghijk Vwxyab.exe Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Vwxyab Defghijk\Group = "Fatal" Vwxyab.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Vwxyab.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Vwxyab.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe 3008 Vwxyab.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2316 2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe Token: SeDebugPrivilege 2528 Vwxyab.exe Token: SeDebugPrivilege 3008 Vwxyab.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2528 wrote to memory of 3008 2528 Vwxyab.exe 29 PID 2528 wrote to memory of 3008 2528 Vwxyab.exe 29 PID 2528 wrote to memory of 3008 2528 Vwxyab.exe 29 PID 2528 wrote to memory of 3008 2528 Vwxyab.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe"C:\Users\Admin\AppData\Local\Temp\2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\Vwxyab.exeC:\Windows\Vwxyab.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
508KB
MD5748153a93ec63ecbbb5dbd4a4c57c34f
SHA141161e254b1112f02be8efc10be58dd2b284a013
SHA2562d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903
SHA512af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe
-
Filesize
508KB
MD5748153a93ec63ecbbb5dbd4a4c57c34f
SHA141161e254b1112f02be8efc10be58dd2b284a013
SHA2562d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903
SHA512af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe
-
Filesize
508KB
MD5748153a93ec63ecbbb5dbd4a4c57c34f
SHA141161e254b1112f02be8efc10be58dd2b284a013
SHA2562d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903
SHA512af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe