Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe
Resource
win7-20230831-en
General
-
Target
d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe
-
Size
1.7MB
-
MD5
7f1cee38087344f909aebfbcb83b9943
-
SHA1
c37d615f08ae0a6d71d1d1df748e91999c0f6fc9
-
SHA256
d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f
-
SHA512
4402520fcc8c39cd09bc2a919eb04df7f386501570576fb6a11716eec7d428c0f014945276cec88e4349de724583c512cc63619a3f770a5a33e347194097ddcc
-
SSDEEP
24576:ei2Tro2H2HESq2eWJ6MQjySjygLNSy7tiHh0dFlXWEXegC:exTc2H2tFvduySbgHh0dFlX
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4864-13-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4864-14-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4864-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3652-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3652-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3652-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4240-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4240-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4240-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4240-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
resource yara_rule behavioral2/memory/4864-13-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4864-14-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4864-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3652-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3652-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3652-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4240-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4240-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4240-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4240-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 4864 RVN.exe 1928 HD_d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe 3652 TXPlatforn.exe 4240 TXPlatforn.exe -
resource yara_rule behavioral2/memory/4864-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4864-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4864-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4864-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3652-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3652-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3652-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4240-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3652-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4240-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4240-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4240-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4944 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4240 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4864 RVN.exe Token: SeLoadDriverPrivilege 4240 TXPlatforn.exe Token: 33 4240 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4240 TXPlatforn.exe Token: 33 4240 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4240 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2756 wrote to memory of 4864 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe 85 PID 2756 wrote to memory of 4864 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe 85 PID 2756 wrote to memory of 4864 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe 85 PID 2756 wrote to memory of 1928 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe 86 PID 2756 wrote to memory of 1928 2756 d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe 86 PID 4864 wrote to memory of 4792 4864 RVN.exe 89 PID 4864 wrote to memory of 4792 4864 RVN.exe 89 PID 4864 wrote to memory of 4792 4864 RVN.exe 89 PID 3652 wrote to memory of 4240 3652 TXPlatforn.exe 88 PID 3652 wrote to memory of 4240 3652 TXPlatforn.exe 88 PID 3652 wrote to memory of 4240 3652 TXPlatforn.exe 88 PID 4792 wrote to memory of 4944 4792 cmd.exe 91 PID 4792 wrote to memory of 4944 4792 cmd.exe 91 PID 4792 wrote to memory of 4944 4792 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe"C:\Users\Admin\AppData\Local\Temp\d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4944
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exeC:\Users\Admin\AppData\Local\Temp\HD_d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe2⤵
- Executes dropped EXE
PID:1928
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1020KB
MD58f904dfc13919403e1c61c1eb5d8e09f
SHA1d587c29c03095f4aa4e43cf6e214b4b692834155
SHA256d3f37da363b1b847cfce5904d3ca7504fdbf0ffabe49944447a1fc9c7df6d7d4
SHA5124a408a282d469f3a98b3a7305eeff85439793ce5581437de48a25c8ff52e8090cd962ab33144bee52f937398b74ebd2b615cff7fe214594e476d3bfe303def80
-
C:\Users\Admin\AppData\Local\Temp\HD_d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe
Filesize727KB
MD548e1bf0b6df63a18187e57348b06ad7e
SHA1605402f1d2ce5a04dd205412ab9edd8f90261967
SHA2568e154ba521608bcf09bba26189e9e1bf86cae70ef7f283579518a641a0ea955f
SHA51254dd1dd4d9e2c7a849fe7576f66870978153976e05b029246ebdf8ae43a70a390c9377296d34dd439530609a42047d8bb8cf6be9a1bb7eff9c4e9d91f5041233
-
C:\Users\Admin\AppData\Local\Temp\HD_d66197ab30a3ab928d063a8342c0e4f0a5eb335a3f1b5e875f90e0641a83d66f.exe
Filesize727KB
MD548e1bf0b6df63a18187e57348b06ad7e
SHA1605402f1d2ce5a04dd205412ab9edd8f90261967
SHA2568e154ba521608bcf09bba26189e9e1bf86cae70ef7f283579518a641a0ea955f
SHA51254dd1dd4d9e2c7a849fe7576f66870978153976e05b029246ebdf8ae43a70a390c9377296d34dd439530609a42047d8bb8cf6be9a1bb7eff9c4e9d91f5041233
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4