Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 17:55
Static task
static1
Behavioral task
behavioral1
Sample
d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe
Resource
win7-20230712-en
General
-
Target
d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe
-
Size
4.2MB
-
MD5
282a98e41f54a76d34fcefc86f623a7a
-
SHA1
6bc551e62c7d899df7ff19b776f81524d66f48b6
-
SHA256
d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436
-
SHA512
eeebb2c37ffa3e45fa40fefdd13d33343132e1cda673c4de93fc2211f3458b81026bcbfad4e610c8c81856121351d2d9e0616232c441e91a2ae1a9aa8fc8b804
-
SSDEEP
49152:K09XJt4HIN2H2tFvduySUbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8R:LZJt4HINy2LkUbXsPN5kiQaZ56
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2024-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2024-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2024-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1460-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2940-67-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2940-69-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2940-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/memory/2024-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2024-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2024-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1460-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2024-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1460-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2940-67-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2940-69-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2940-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 2024 RVN.exe 3056 HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 1460 TXPlatforn.exe 2940 TXPlatforn.exe -
Loads dropped DLL 3 IoCs
pid Process 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 1460 TXPlatforn.exe -
resource yara_rule behavioral1/memory/2024-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2024-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2024-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2024-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1460-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2024-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1460-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2940-67-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2940-69-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2940-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2704 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2940 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2024 RVN.exe Token: SeLoadDriverPrivilege 2940 TXPlatforn.exe Token: 33 2940 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2940 TXPlatforn.exe Token: 33 2940 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2940 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2024 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 28 PID 2608 wrote to memory of 2024 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 28 PID 2608 wrote to memory of 2024 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 28 PID 2608 wrote to memory of 2024 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 28 PID 2608 wrote to memory of 2024 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 28 PID 2608 wrote to memory of 2024 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 28 PID 2608 wrote to memory of 2024 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 28 PID 2608 wrote to memory of 3056 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 32 PID 2608 wrote to memory of 3056 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 32 PID 2608 wrote to memory of 3056 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 32 PID 2608 wrote to memory of 3056 2608 d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe 32 PID 2024 wrote to memory of 2196 2024 RVN.exe 33 PID 2024 wrote to memory of 2196 2024 RVN.exe 33 PID 2024 wrote to memory of 2196 2024 RVN.exe 33 PID 2024 wrote to memory of 2196 2024 RVN.exe 33 PID 1460 wrote to memory of 2940 1460 TXPlatforn.exe 35 PID 1460 wrote to memory of 2940 1460 TXPlatforn.exe 35 PID 1460 wrote to memory of 2940 1460 TXPlatforn.exe 35 PID 1460 wrote to memory of 2940 1460 TXPlatforn.exe 35 PID 1460 wrote to memory of 2940 1460 TXPlatforn.exe 35 PID 1460 wrote to memory of 2940 1460 TXPlatforn.exe 35 PID 1460 wrote to memory of 2940 1460 TXPlatforn.exe 35 PID 2196 wrote to memory of 2704 2196 cmd.exe 36 PID 2196 wrote to memory of 2704 2196 cmd.exe 36 PID 2196 wrote to memory of 2704 2196 cmd.exe 36 PID 2196 wrote to memory of 2704 2196 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe"C:\Users\Admin\AppData\Local\Temp\d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2704
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exeC:\Users\Admin\AppData\Local\Temp\HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe2⤵
- Executes dropped EXE
PID:3056
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5ca0aaa0529dfe4d25233cb91c86adc85
SHA1ce2a1d6eef2609552eefbdb2ad3ebf93364ed07e
SHA2567c8407fd0e53ed680ca6b02a7e68e88b76495b14ce4baa46d290b91492003fe0
SHA512d3aa29f5792240610e70fd15bf1e8fe177912984fee19478ea2e81cc77595c8503e17b108344b600cc32b8e288d831dc27d860616c0c84347d0a09b4900b82ee
-
C:\Users\Admin\AppData\Local\Temp\HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe
Filesize3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
\Users\Admin\AppData\Local\Temp\HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe
Filesize3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4