Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
30/09/2023, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
17f89183d951f5ea258d8d242368a3d8.exe
Resource
win7-20230831-en
General
-
Target
17f89183d951f5ea258d8d242368a3d8.exe
-
Size
612KB
-
MD5
17f89183d951f5ea258d8d242368a3d8
-
SHA1
41d7143f06a9fe53b6d8fda2b6d7c629c7a7a133
-
SHA256
e54c38c8d43f2a11ac1c997438d4586a3270f1545f8ef02b8992ebc35005823c
-
SHA512
65e59efd1e77def251c8def6065b7eb1c8944c0ec3c29f0b59eac3c7aa3dd1ced8b4ac5993804736a6b724528ce36fbd6aaf6c05c86e594eb7a61de644f0d71d
-
SSDEEP
12288:NcrNS33L10QdrXjZDnDLRH6/cOOScBEcmJE28syNM34odu+K:wNA3R5drX1DDLRHMncBeFySIodrK
Malware Config
Extracted
asyncrat
0.5.7B
Default8
185.225.73.105:8675
185.225.73.105:7896
mloptuytonroyem.sytes.net:8675
mloptuytonroyem.sytes.net:7896
AsyncMutex_7SI8ObPWc
-
delay
3
-
install
true
-
install_file
cesr.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 4 IoCs
resource yara_rule behavioral1/memory/1992-44-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1992-47-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1992-50-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1992-52-0x0000000004DE0000-0x0000000004E20000-memory.dmp asyncrat -
Executes dropped EXE 5 IoCs
pid Process 3044 jzfjgshg.sfx.exe 320 jzfjgshg.exe 1992 jzfjgshg.exe 2860 cesr.exe 1808 cesr.exe -
Loads dropped DLL 7 IoCs
pid Process 2744 cmd.exe 3044 jzfjgshg.sfx.exe 3044 jzfjgshg.sfx.exe 3044 jzfjgshg.sfx.exe 3044 jzfjgshg.sfx.exe 320 jzfjgshg.exe 1656 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 320 set thread context of 1992 320 jzfjgshg.exe 32 PID 2860 set thread context of 1808 2860 cesr.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2904 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1560 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1992 jzfjgshg.exe 1992 jzfjgshg.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 320 jzfjgshg.exe Token: SeDebugPrivilege 1992 jzfjgshg.exe Token: SeDebugPrivilege 2860 cesr.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2744 2412 17f89183d951f5ea258d8d242368a3d8.exe 28 PID 2412 wrote to memory of 2744 2412 17f89183d951f5ea258d8d242368a3d8.exe 28 PID 2412 wrote to memory of 2744 2412 17f89183d951f5ea258d8d242368a3d8.exe 28 PID 2412 wrote to memory of 2744 2412 17f89183d951f5ea258d8d242368a3d8.exe 28 PID 2744 wrote to memory of 3044 2744 cmd.exe 30 PID 2744 wrote to memory of 3044 2744 cmd.exe 30 PID 2744 wrote to memory of 3044 2744 cmd.exe 30 PID 2744 wrote to memory of 3044 2744 cmd.exe 30 PID 3044 wrote to memory of 320 3044 jzfjgshg.sfx.exe 31 PID 3044 wrote to memory of 320 3044 jzfjgshg.sfx.exe 31 PID 3044 wrote to memory of 320 3044 jzfjgshg.sfx.exe 31 PID 3044 wrote to memory of 320 3044 jzfjgshg.sfx.exe 31 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 320 wrote to memory of 1992 320 jzfjgshg.exe 32 PID 1992 wrote to memory of 2796 1992 jzfjgshg.exe 34 PID 1992 wrote to memory of 2796 1992 jzfjgshg.exe 34 PID 1992 wrote to memory of 2796 1992 jzfjgshg.exe 34 PID 1992 wrote to memory of 2796 1992 jzfjgshg.exe 34 PID 1992 wrote to memory of 1656 1992 jzfjgshg.exe 36 PID 1992 wrote to memory of 1656 1992 jzfjgshg.exe 36 PID 1992 wrote to memory of 1656 1992 jzfjgshg.exe 36 PID 1992 wrote to memory of 1656 1992 jzfjgshg.exe 36 PID 2796 wrote to memory of 2904 2796 cmd.exe 38 PID 2796 wrote to memory of 2904 2796 cmd.exe 38 PID 2796 wrote to memory of 2904 2796 cmd.exe 38 PID 2796 wrote to memory of 2904 2796 cmd.exe 38 PID 1656 wrote to memory of 1560 1656 cmd.exe 39 PID 1656 wrote to memory of 1560 1656 cmd.exe 39 PID 1656 wrote to memory of 1560 1656 cmd.exe 39 PID 1656 wrote to memory of 1560 1656 cmd.exe 39 PID 1656 wrote to memory of 2860 1656 cmd.exe 40 PID 1656 wrote to memory of 2860 1656 cmd.exe 40 PID 1656 wrote to memory of 2860 1656 cmd.exe 40 PID 1656 wrote to memory of 2860 1656 cmd.exe 40 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41 PID 2860 wrote to memory of 1808 2860 cesr.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\17f89183d951f5ea258d8d242368a3d8.exe"C:\Users\Admin\AppData\Local\Temp\17f89183d951f5ea258d8d242368a3d8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\agwkien.cmd" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\jzfjgshg.sfx.exejzfjgshg.sfx.exe -pwejtnhlopfigsohdfuishgrygfysrsoihfihgsoifghsithngmkaswodtyuiofxvflfadfdyehngfszafugyRhhguhrsugsudbfrgsfskfshbrkgysgrhgnmePvqxsHb -dC:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe"C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\jzfjgshg.exeC:\Users\Admin\AppData\Local\Temp\jzfjgshg.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cesr" /tr '"C:\Users\Admin\AppData\Roaming\cesr.exe"' & exit6⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "cesr" /tr '"C:\Users\Admin\AppData\Roaming\cesr.exe"'7⤵
- Creates scheduled task(s)
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5CEF.tmp.bat""6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
PID:1560
-
-
C:\Users\Admin\AppData\Roaming\cesr.exe"C:\Users\Admin\AppData\Roaming\cesr.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\cesr.exeC:\Users\Admin\AppData\Roaming\cesr.exe8⤵
- Executes dropped EXE
PID:1808
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD51b691bb471660c064a30e159bc156d25
SHA131e5129cf89dd20eedf400e13e41785f8ab049de
SHA256dd841bc52a05aba3635172cc4af2687f9e5c896fc22ea10185bb370ffd43e16f
SHA512b63a20ec64c046289ea60c9c4ba394d6739371bed8b58a798fa15d9ab2dda145da231d8186e366c05422e5633fde9b46edf78af8f8ef81ea12a7b3b3b1d818b6
-
Filesize
19KB
MD51b691bb471660c064a30e159bc156d25
SHA131e5129cf89dd20eedf400e13e41785f8ab049de
SHA256dd841bc52a05aba3635172cc4af2687f9e5c896fc22ea10185bb370ffd43e16f
SHA512b63a20ec64c046289ea60c9c4ba394d6739371bed8b58a798fa15d9ab2dda145da231d8186e366c05422e5633fde9b46edf78af8f8ef81ea12a7b3b3b1d818b6
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
459KB
MD57eb26e1af91272a1f854376abb42070c
SHA15f31cec81e54ecf59953fde86ad8f09823a8431f
SHA25672c92e967547988bf22adc7f66304780efc3f70627dfd4e54024dd2f9f68c634
SHA512264998421b7baa475836f03ee5ed0c6005528a404d172125ee680a784a09c4673385fc5e374dc6a5d99106a235db36e201da8138c47cfcd1e6cbcd3d64b45cee
-
Filesize
459KB
MD57eb26e1af91272a1f854376abb42070c
SHA15f31cec81e54ecf59953fde86ad8f09823a8431f
SHA25672c92e967547988bf22adc7f66304780efc3f70627dfd4e54024dd2f9f68c634
SHA512264998421b7baa475836f03ee5ed0c6005528a404d172125ee680a784a09c4673385fc5e374dc6a5d99106a235db36e201da8138c47cfcd1e6cbcd3d64b45cee
-
Filesize
148B
MD51f5d861929cbffb096c63448e492da2d
SHA1401d3e9699bcb843c2a6d564260f5b1b4b9b3f72
SHA2565edc698f2621f2985649086785d0383495002a768b59d318bcf62d695f3af714
SHA5127baec9e0930d3bd1ff9d17659253553fc5e3adde828e43878c04fc1408965063c1c99eff07317e78d423dc8b76395b8eda42addc05a505d299c364108808d837
-
Filesize
148B
MD51f5d861929cbffb096c63448e492da2d
SHA1401d3e9699bcb843c2a6d564260f5b1b4b9b3f72
SHA2565edc698f2621f2985649086785d0383495002a768b59d318bcf62d695f3af714
SHA5127baec9e0930d3bd1ff9d17659253553fc5e3adde828e43878c04fc1408965063c1c99eff07317e78d423dc8b76395b8eda42addc05a505d299c364108808d837
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75
-
Filesize
459KB
MD57eb26e1af91272a1f854376abb42070c
SHA15f31cec81e54ecf59953fde86ad8f09823a8431f
SHA25672c92e967547988bf22adc7f66304780efc3f70627dfd4e54024dd2f9f68c634
SHA512264998421b7baa475836f03ee5ed0c6005528a404d172125ee680a784a09c4673385fc5e374dc6a5d99106a235db36e201da8138c47cfcd1e6cbcd3d64b45cee
-
Filesize
234KB
MD525ff024ae3b00e8dc5d53d82681d25e5
SHA1d09df86d87cc2a7e022358eb388feb4f33234ebc
SHA25620d829712638e1cf6dac27bdcc57f247a24a7de8fba941568dd41e869d84f75c
SHA51232f5e4ccdaaa1c56c85419576b0e8ed247b9fdd12e2a3c6e76f2e4f46218dfe46fcff790b87d75d49b901442336b9b6ace767ddc148e8c10923292504d40ee75