Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2023, 23:34

General

  • Target

    2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe

  • Size

    508KB

  • MD5

    748153a93ec63ecbbb5dbd4a4c57c34f

  • SHA1

    41161e254b1112f02be8efc10be58dd2b284a013

  • SHA256

    2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903

  • SHA512

    af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe

  • SSDEEP

    6144:gqRtk+feyFwSzkPDNGEfDVFG1wqBVb1w1s:Jtk+8ykLlpF6PVR9

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

  • Fatal Rat payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies data under HKEY_USERS 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe
    "C:\Users\Admin\AppData\Local\Temp\2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2316
  • C:\Windows\Vwxyab.exe
    C:\Windows\Vwxyab.exe
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\Vwxyab.exe
      C:\Windows\Vwxyab.exe Win7
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Vwxyab.exe

    Filesize

    508KB

    MD5

    748153a93ec63ecbbb5dbd4a4c57c34f

    SHA1

    41161e254b1112f02be8efc10be58dd2b284a013

    SHA256

    2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903

    SHA512

    af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe

  • C:\Windows\Vwxyab.exe

    Filesize

    508KB

    MD5

    748153a93ec63ecbbb5dbd4a4c57c34f

    SHA1

    41161e254b1112f02be8efc10be58dd2b284a013

    SHA256

    2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903

    SHA512

    af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe

  • C:\Windows\Vwxyab.exe

    Filesize

    508KB

    MD5

    748153a93ec63ecbbb5dbd4a4c57c34f

    SHA1

    41161e254b1112f02be8efc10be58dd2b284a013

    SHA256

    2d68ea954ba7ff7da8b6f8d9003943d9cb314493d5c8e0b04146c2bb67884903

    SHA512

    af43c1c6f77415253a9fd8288a8944d347bd342aa62ef7fdcdbb48ca24eab86f012aa932d2d9360e0a88a397bf45ef65f5e0de1607bcd5d76ed55f63d88e49fe

  • memory/2316-54-0x0000000010000000-0x000000001002A000-memory.dmp

    Filesize

    168KB