Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    17/09/2023, 10:16

General

  • Target

    27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe

  • Size

    235KB

  • MD5

    a9e4aa023ae9d9b512963499d80738c3

  • SHA1

    17692ef022de815d2170f8ef4b028219ac93a3aa

  • SHA256

    27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2

  • SHA512

    6e995fb213bda5e6c7a8eb89e08edcc0a125968a0f44724c74cf163bf93bde2fc414c98634f7bc69b8f0bd08be934c3958f3bad6105011367a36df7417be6f17

  • SSDEEP

    6144:PEVkyf8W4pFwGPodNdPwjYXAO0T6/35iVvPN:PEVkm74pKyjjK2T6/35ipPN

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Fatal Rat payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe
    "C:\Users\Admin\AppData\Local\Temp\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2480
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command -
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2800
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command -
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1904
    • C:\Users\Admin\AppData\Local\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe
      "C:\Users\Admin\AppData\Local\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:324
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command -
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1300
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:460
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command -
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe

    Filesize

    235KB

    MD5

    a9e4aa023ae9d9b512963499d80738c3

    SHA1

    17692ef022de815d2170f8ef4b028219ac93a3aa

    SHA256

    27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2

    SHA512

    6e995fb213bda5e6c7a8eb89e08edcc0a125968a0f44724c74cf163bf93bde2fc414c98634f7bc69b8f0bd08be934c3958f3bad6105011367a36df7417be6f17

  • C:\Users\Admin\AppData\Local\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe

    Filesize

    235KB

    MD5

    a9e4aa023ae9d9b512963499d80738c3

    SHA1

    17692ef022de815d2170f8ef4b028219ac93a3aa

    SHA256

    27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2

    SHA512

    6e995fb213bda5e6c7a8eb89e08edcc0a125968a0f44724c74cf163bf93bde2fc414c98634f7bc69b8f0bd08be934c3958f3bad6105011367a36df7417be6f17

  • C:\Users\Admin\AppData\Local\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe

    Filesize

    235KB

    MD5

    a9e4aa023ae9d9b512963499d80738c3

    SHA1

    17692ef022de815d2170f8ef4b028219ac93a3aa

    SHA256

    27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2

    SHA512

    6e995fb213bda5e6c7a8eb89e08edcc0a125968a0f44724c74cf163bf93bde2fc414c98634f7bc69b8f0bd08be934c3958f3bad6105011367a36df7417be6f17

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RBWB92VDYTS4CWDCKYUQ.temp

    Filesize

    7KB

    MD5

    7c3bac698940c0cadb21cad8147108ce

    SHA1

    c0f2f3eb608391b07c6a6b9e72478d45d1a8c87a

    SHA256

    491a241997aa675f6553023b64fa5bd23bc9249aebde7d43f48365b10fae0921

    SHA512

    3ee6d98a905a8e2e8ba0c53fdcbc4f458ca84ed7b76408ee925bd30f321c06e5fd64a21cf918d01f132a7ba2df6a4f55577e98c012c14441d95c75cf2eb7e68b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    7c3bac698940c0cadb21cad8147108ce

    SHA1

    c0f2f3eb608391b07c6a6b9e72478d45d1a8c87a

    SHA256

    491a241997aa675f6553023b64fa5bd23bc9249aebde7d43f48365b10fae0921

    SHA512

    3ee6d98a905a8e2e8ba0c53fdcbc4f458ca84ed7b76408ee925bd30f321c06e5fd64a21cf918d01f132a7ba2df6a4f55577e98c012c14441d95c75cf2eb7e68b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    4014256536a8696570fc4314568ae266

    SHA1

    c20a28b0d081faa55ab020bfc3f55f15f90c5287

    SHA256

    b2363f960055d56b0be7ad1134f8300e0eb7d09f6b17bcdda2630a197204303f

    SHA512

    563151713c9f0a9d1503f729ca70ada234a7341a948f41f80fd49ee27f77827ea87c6d294545452e2981bf3ee55b6d7286fad5c4f57dea828508f9a51a125d8c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    4014256536a8696570fc4314568ae266

    SHA1

    c20a28b0d081faa55ab020bfc3f55f15f90c5287

    SHA256

    b2363f960055d56b0be7ad1134f8300e0eb7d09f6b17bcdda2630a197204303f

    SHA512

    563151713c9f0a9d1503f729ca70ada234a7341a948f41f80fd49ee27f77827ea87c6d294545452e2981bf3ee55b6d7286fad5c4f57dea828508f9a51a125d8c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    7c3bac698940c0cadb21cad8147108ce

    SHA1

    c0f2f3eb608391b07c6a6b9e72478d45d1a8c87a

    SHA256

    491a241997aa675f6553023b64fa5bd23bc9249aebde7d43f48365b10fae0921

    SHA512

    3ee6d98a905a8e2e8ba0c53fdcbc4f458ca84ed7b76408ee925bd30f321c06e5fd64a21cf918d01f132a7ba2df6a4f55577e98c012c14441d95c75cf2eb7e68b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    7c3bac698940c0cadb21cad8147108ce

    SHA1

    c0f2f3eb608391b07c6a6b9e72478d45d1a8c87a

    SHA256

    491a241997aa675f6553023b64fa5bd23bc9249aebde7d43f48365b10fae0921

    SHA512

    3ee6d98a905a8e2e8ba0c53fdcbc4f458ca84ed7b76408ee925bd30f321c06e5fd64a21cf918d01f132a7ba2df6a4f55577e98c012c14441d95c75cf2eb7e68b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    4014256536a8696570fc4314568ae266

    SHA1

    c20a28b0d081faa55ab020bfc3f55f15f90c5287

    SHA256

    b2363f960055d56b0be7ad1134f8300e0eb7d09f6b17bcdda2630a197204303f

    SHA512

    563151713c9f0a9d1503f729ca70ada234a7341a948f41f80fd49ee27f77827ea87c6d294545452e2981bf3ee55b6d7286fad5c4f57dea828508f9a51a125d8c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    7c3bac698940c0cadb21cad8147108ce

    SHA1

    c0f2f3eb608391b07c6a6b9e72478d45d1a8c87a

    SHA256

    491a241997aa675f6553023b64fa5bd23bc9249aebde7d43f48365b10fae0921

    SHA512

    3ee6d98a905a8e2e8ba0c53fdcbc4f458ca84ed7b76408ee925bd30f321c06e5fd64a21cf918d01f132a7ba2df6a4f55577e98c012c14441d95c75cf2eb7e68b

  • C:\Users\Default\Desktop\athletes.exe

    Filesize

    235KB

    MD5

    a9e4aa023ae9d9b512963499d80738c3

    SHA1

    17692ef022de815d2170f8ef4b028219ac93a3aa

    SHA256

    27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2

    SHA512

    6e995fb213bda5e6c7a8eb89e08edcc0a125968a0f44724c74cf163bf93bde2fc414c98634f7bc69b8f0bd08be934c3958f3bad6105011367a36df7417be6f17

  • \Users\Admin\AppData\Local\27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2.exe

    Filesize

    235KB

    MD5

    a9e4aa023ae9d9b512963499d80738c3

    SHA1

    17692ef022de815d2170f8ef4b028219ac93a3aa

    SHA256

    27d7ca6b9c3a88a89809c12dbc29374af3a33adace5b4c312d9fd21e280e7fc2

    SHA512

    6e995fb213bda5e6c7a8eb89e08edcc0a125968a0f44724c74cf163bf93bde2fc414c98634f7bc69b8f0bd08be934c3958f3bad6105011367a36df7417be6f17

  • memory/112-116-0x0000000002D10000-0x0000000002E10000-memory.dmp

    Filesize

    1024KB

  • memory/112-117-0x0000000010000000-0x0000000010042000-memory.dmp

    Filesize

    264KB

  • memory/112-115-0x0000000002D10000-0x0000000002E10000-memory.dmp

    Filesize

    1024KB

  • memory/112-123-0x0000000002D10000-0x0000000002E10000-memory.dmp

    Filesize

    1024KB

  • memory/112-124-0x0000000002D10000-0x0000000002E10000-memory.dmp

    Filesize

    1024KB

  • memory/324-73-0x0000000002410000-0x0000000002450000-memory.dmp

    Filesize

    256KB

  • memory/324-67-0x00000000739D0000-0x0000000073F7B000-memory.dmp

    Filesize

    5.7MB

  • memory/324-66-0x00000000739D0000-0x0000000073F7B000-memory.dmp

    Filesize

    5.7MB

  • memory/324-68-0x0000000002410000-0x0000000002450000-memory.dmp

    Filesize

    256KB

  • memory/324-69-0x0000000002410000-0x0000000002450000-memory.dmp

    Filesize

    256KB

  • memory/324-70-0x00000000739D0000-0x0000000073F7B000-memory.dmp

    Filesize

    5.7MB

  • memory/324-71-0x0000000002410000-0x0000000002450000-memory.dmp

    Filesize

    256KB

  • memory/324-72-0x0000000002410000-0x0000000002450000-memory.dmp

    Filesize

    256KB

  • memory/460-95-0x00000000022E0000-0x0000000002320000-memory.dmp

    Filesize

    256KB

  • memory/460-94-0x0000000073E00000-0x00000000743AB000-memory.dmp

    Filesize

    5.7MB

  • memory/460-100-0x00000000022E0000-0x0000000002320000-memory.dmp

    Filesize

    256KB

  • memory/460-99-0x00000000022E0000-0x0000000002320000-memory.dmp

    Filesize

    256KB

  • memory/460-98-0x0000000073E00000-0x00000000743AB000-memory.dmp

    Filesize

    5.7MB

  • memory/460-97-0x00000000022E0000-0x0000000002320000-memory.dmp

    Filesize

    256KB

  • memory/460-96-0x0000000073E00000-0x00000000743AB000-memory.dmp

    Filesize

    5.7MB

  • memory/1300-84-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/1300-81-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/1300-85-0x0000000002860000-0x00000000028A0000-memory.dmp

    Filesize

    256KB

  • memory/1300-82-0x0000000002860000-0x00000000028A0000-memory.dmp

    Filesize

    256KB

  • memory/1300-83-0x0000000002860000-0x00000000028A0000-memory.dmp

    Filesize

    256KB

  • memory/1300-80-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/1804-112-0x00000000026B0000-0x00000000026F0000-memory.dmp

    Filesize

    256KB

  • memory/1804-111-0x00000000026B0000-0x00000000026F0000-memory.dmp

    Filesize

    256KB

  • memory/1804-110-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/1804-108-0x00000000026B0000-0x00000000026F0000-memory.dmp

    Filesize

    256KB

  • memory/1804-109-0x00000000026B0000-0x00000000026F0000-memory.dmp

    Filesize

    256KB

  • memory/1804-107-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/1804-106-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/1904-40-0x0000000073E10000-0x00000000743BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1904-43-0x0000000073E10000-0x00000000743BB000-memory.dmp

    Filesize

    5.7MB

  • memory/1904-41-0x0000000002920000-0x0000000002960000-memory.dmp

    Filesize

    256KB

  • memory/1904-42-0x0000000073E10000-0x00000000743BB000-memory.dmp

    Filesize

    5.7MB

  • memory/2092-47-0x00000000029D0000-0x0000000002AD0000-memory.dmp

    Filesize

    1024KB

  • memory/2092-45-0x00000000029D0000-0x0000000002AD0000-memory.dmp

    Filesize

    1024KB

  • memory/2092-48-0x0000000010000000-0x0000000010042000-memory.dmp

    Filesize

    264KB

  • memory/2480-3-0x00000000739F0000-0x0000000073F9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2480-4-0x0000000002160000-0x00000000021A0000-memory.dmp

    Filesize

    256KB

  • memory/2480-5-0x0000000002160000-0x00000000021A0000-memory.dmp

    Filesize

    256KB

  • memory/2480-6-0x00000000739F0000-0x0000000073F9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2480-7-0x0000000002160000-0x00000000021A0000-memory.dmp

    Filesize

    256KB

  • memory/2480-2-0x00000000739F0000-0x0000000073F9B000-memory.dmp

    Filesize

    5.7MB

  • memory/2668-29-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

  • memory/2668-30-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2668-32-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

  • memory/2668-26-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2668-27-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

  • memory/2668-28-0x0000000073E20000-0x00000000743CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2668-31-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

  • memory/2668-33-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

  • memory/2800-17-0x0000000073A30000-0x0000000073FDB000-memory.dmp

    Filesize

    5.7MB

  • memory/2800-13-0x0000000073A30000-0x0000000073FDB000-memory.dmp

    Filesize

    5.7MB

  • memory/2800-15-0x0000000002170000-0x00000000021B0000-memory.dmp

    Filesize

    256KB

  • memory/2800-14-0x0000000002170000-0x00000000021B0000-memory.dmp

    Filesize

    256KB

  • memory/2800-16-0x0000000073A30000-0x0000000073FDB000-memory.dmp

    Filesize

    5.7MB

  • memory/2800-19-0x0000000002170000-0x00000000021B0000-memory.dmp

    Filesize

    256KB

  • memory/2800-18-0x0000000002170000-0x00000000021B0000-memory.dmp

    Filesize

    256KB