Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2023, 17:07

General

  • Target

    17f89183d951f5ea258d8d242368a3d8.exe

  • Size

    612KB

  • MD5

    17f89183d951f5ea258d8d242368a3d8

  • SHA1

    41d7143f06a9fe53b6d8fda2b6d7c629c7a7a133

  • SHA256

    e54c38c8d43f2a11ac1c997438d4586a3270f1545f8ef02b8992ebc35005823c

  • SHA512

    65e59efd1e77def251c8def6065b7eb1c8944c0ec3c29f0b59eac3c7aa3dd1ced8b4ac5993804736a6b724528ce36fbd6aaf6c05c86e594eb7a61de644f0d71d

  • SSDEEP

    12288:NcrNS33L10QdrXjZDnDLRH6/cOOScBEcmJE28syNM34odu+K:wNA3R5drX1DDLRHMncBeFySIodrK

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default8

C2

185.225.73.105:8675

185.225.73.105:7896

mloptuytonroyem.sytes.net:8675

mloptuytonroyem.sytes.net:7896

Mutex

AsyncMutex_7SI8ObPWc

Attributes
  • delay

    3

  • install

    true

  • install_file

    cesr.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Async RAT payload 4 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17f89183d951f5ea258d8d242368a3d8.exe
    "C:\Users\Admin\AppData\Local\Temp\17f89183d951f5ea258d8d242368a3d8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\agwkien.cmd" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.sfx.exe
        jzfjgshg.sfx.exe -pwejtnhlopfigsohdfuishgrygfysrsoihfihgsoifghsithngmkaswodtyuiofxvflfadfdyehngfszafugyRhhguhrsugsudbfrgsfskfshbrkgysgrhgnmePvqxsHb -dC:\Users\Admin\AppData\Local\Temp
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe
          "C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:320
          • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe
            C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cesr" /tr '"C:\Users\Admin\AppData\Roaming\cesr.exe"' & exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2796
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /f /sc onlogon /rl highest /tn "cesr" /tr '"C:\Users\Admin\AppData\Roaming\cesr.exe"'
                7⤵
                • Creates scheduled task(s)
                PID:2904
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5CEF.tmp.bat""
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1656
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                7⤵
                • Delays execution with timeout.exe
                PID:1560
              • C:\Users\Admin\AppData\Roaming\cesr.exe
                "C:\Users\Admin\AppData\Roaming\cesr.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2860
                • C:\Users\Admin\AppData\Roaming\cesr.exe
                  C:\Users\Admin\AppData\Roaming\cesr.exe
                  8⤵
                  • Executes dropped EXE
                  PID:1808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\agwkien.cmd

    Filesize

    19KB

    MD5

    1b691bb471660c064a30e159bc156d25

    SHA1

    31e5129cf89dd20eedf400e13e41785f8ab049de

    SHA256

    dd841bc52a05aba3635172cc4af2687f9e5c896fc22ea10185bb370ffd43e16f

    SHA512

    b63a20ec64c046289ea60c9c4ba394d6739371bed8b58a798fa15d9ab2dda145da231d8186e366c05422e5633fde9b46edf78af8f8ef81ea12a7b3b3b1d818b6

  • C:\Users\Admin\AppData\Local\Temp\agwkien.cmd

    Filesize

    19KB

    MD5

    1b691bb471660c064a30e159bc156d25

    SHA1

    31e5129cf89dd20eedf400e13e41785f8ab049de

    SHA256

    dd841bc52a05aba3635172cc4af2687f9e5c896fc22ea10185bb370ffd43e16f

    SHA512

    b63a20ec64c046289ea60c9c4ba394d6739371bed8b58a798fa15d9ab2dda145da231d8186e366c05422e5633fde9b46edf78af8f8ef81ea12a7b3b3b1d818b6

  • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.sfx.exe

    Filesize

    459KB

    MD5

    7eb26e1af91272a1f854376abb42070c

    SHA1

    5f31cec81e54ecf59953fde86ad8f09823a8431f

    SHA256

    72c92e967547988bf22adc7f66304780efc3f70627dfd4e54024dd2f9f68c634

    SHA512

    264998421b7baa475836f03ee5ed0c6005528a404d172125ee680a784a09c4673385fc5e374dc6a5d99106a235db36e201da8138c47cfcd1e6cbcd3d64b45cee

  • C:\Users\Admin\AppData\Local\Temp\jzfjgshg.sfx.exe

    Filesize

    459KB

    MD5

    7eb26e1af91272a1f854376abb42070c

    SHA1

    5f31cec81e54ecf59953fde86ad8f09823a8431f

    SHA256

    72c92e967547988bf22adc7f66304780efc3f70627dfd4e54024dd2f9f68c634

    SHA512

    264998421b7baa475836f03ee5ed0c6005528a404d172125ee680a784a09c4673385fc5e374dc6a5d99106a235db36e201da8138c47cfcd1e6cbcd3d64b45cee

  • C:\Users\Admin\AppData\Local\Temp\tmp5CEF.tmp.bat

    Filesize

    148B

    MD5

    1f5d861929cbffb096c63448e492da2d

    SHA1

    401d3e9699bcb843c2a6d564260f5b1b4b9b3f72

    SHA256

    5edc698f2621f2985649086785d0383495002a768b59d318bcf62d695f3af714

    SHA512

    7baec9e0930d3bd1ff9d17659253553fc5e3adde828e43878c04fc1408965063c1c99eff07317e78d423dc8b76395b8eda42addc05a505d299c364108808d837

  • C:\Users\Admin\AppData\Local\Temp\tmp5CEF.tmp.bat

    Filesize

    148B

    MD5

    1f5d861929cbffb096c63448e492da2d

    SHA1

    401d3e9699bcb843c2a6d564260f5b1b4b9b3f72

    SHA256

    5edc698f2621f2985649086785d0383495002a768b59d318bcf62d695f3af714

    SHA512

    7baec9e0930d3bd1ff9d17659253553fc5e3adde828e43878c04fc1408965063c1c99eff07317e78d423dc8b76395b8eda42addc05a505d299c364108808d837

  • C:\Users\Admin\AppData\Roaming\cesr.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • C:\Users\Admin\AppData\Roaming\cesr.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • C:\Users\Admin\AppData\Roaming\cesr.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • \Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • \Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • \Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • \Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • \Users\Admin\AppData\Local\Temp\jzfjgshg.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • \Users\Admin\AppData\Local\Temp\jzfjgshg.sfx.exe

    Filesize

    459KB

    MD5

    7eb26e1af91272a1f854376abb42070c

    SHA1

    5f31cec81e54ecf59953fde86ad8f09823a8431f

    SHA256

    72c92e967547988bf22adc7f66304780efc3f70627dfd4e54024dd2f9f68c634

    SHA512

    264998421b7baa475836f03ee5ed0c6005528a404d172125ee680a784a09c4673385fc5e374dc6a5d99106a235db36e201da8138c47cfcd1e6cbcd3d64b45cee

  • \Users\Admin\AppData\Roaming\cesr.exe

    Filesize

    234KB

    MD5

    25ff024ae3b00e8dc5d53d82681d25e5

    SHA1

    d09df86d87cc2a7e022358eb388feb4f33234ebc

    SHA256

    20d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c

    SHA512

    32f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75

  • memory/320-38-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/320-39-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/320-37-0x0000000000FA0000-0x0000000000FE0000-memory.dmp

    Filesize

    256KB

  • memory/320-42-0x0000000000630000-0x0000000000636000-memory.dmp

    Filesize

    24KB

  • memory/320-48-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/320-41-0x0000000000890000-0x00000000008CE000-memory.dmp

    Filesize

    248KB

  • memory/320-40-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

    Filesize

    256KB

  • memory/1992-51-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/1992-61-0x0000000073D60000-0x000000007444E000-memory.dmp

    Filesize

    6.9MB

  • memory/1992-52-0x0000000004DE0000-0x0000000004E20000-memory.dmp

    Filesize

    256KB

  • memory/1992-50-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1992-47-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1992-44-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/2860-67-0x0000000073F10000-0x00000000745FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2860-66-0x0000000000070000-0x00000000000B0000-memory.dmp

    Filesize

    256KB

  • memory/2860-70-0x0000000073F10000-0x00000000745FE000-memory.dmp

    Filesize

    6.9MB