Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe
Resource
win7-20230831-en
General
-
Target
5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe
-
Size
3.2MB
-
MD5
d18f878cd976e18f23b19c0a6809df06
-
SHA1
1a3a31612889de8d194289ff0d20be4e7373ff38
-
SHA256
5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9
-
SHA512
a1a3df4db86746f790be8b516559cdc4e30b82f677c0c97d8de532f761601497d4e581b25c61bd041fc170f347821a233a9088c37a1fbfdc39362364444fa4b3
-
SSDEEP
49152:p89XJt4HIZ/Gg0P+Wh81iWwV9wxTeIJtk5/IjTf5GelUXKerOmhis:OZJt4HIZOgmh8AvodLJtk/elc
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2912-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2912-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2912-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1716-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1440-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1440-70-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1440-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/memory/2912-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1716-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1716-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1440-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1440-70-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1440-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 2912 QQ.exe 1716 TXPlatforn.exe 1440 TXPlatforn.exe 3040 HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
Loads dropped DLL 3 IoCs
pid Process 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 1716 TXPlatforn.exe 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
resource yara_rule behavioral1/memory/2912-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1716-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1716-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1440-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1440-70-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1440-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2520 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1440 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2912 QQ.exe Token: SeLoadDriverPrivilege 1440 TXPlatforn.exe Token: 33 1440 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1440 TXPlatforn.exe Token: 33 1440 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1440 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2912 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 28 PID 1752 wrote to memory of 2912 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 28 PID 1752 wrote to memory of 2912 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 28 PID 1752 wrote to memory of 2912 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 28 PID 1752 wrote to memory of 2912 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 28 PID 1752 wrote to memory of 2912 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 28 PID 1752 wrote to memory of 2912 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 28 PID 2912 wrote to memory of 2040 2912 QQ.exe 33 PID 2912 wrote to memory of 2040 2912 QQ.exe 33 PID 2912 wrote to memory of 2040 2912 QQ.exe 33 PID 2912 wrote to memory of 2040 2912 QQ.exe 33 PID 1716 wrote to memory of 1440 1716 TXPlatforn.exe 31 PID 1716 wrote to memory of 1440 1716 TXPlatforn.exe 31 PID 1716 wrote to memory of 1440 1716 TXPlatforn.exe 31 PID 1716 wrote to memory of 1440 1716 TXPlatforn.exe 31 PID 1716 wrote to memory of 1440 1716 TXPlatforn.exe 31 PID 1716 wrote to memory of 1440 1716 TXPlatforn.exe 31 PID 1716 wrote to memory of 1440 1716 TXPlatforn.exe 31 PID 1752 wrote to memory of 3040 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 30 PID 1752 wrote to memory of 3040 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 30 PID 1752 wrote to memory of 3040 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 30 PID 1752 wrote to memory of 3040 1752 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 30 PID 2040 wrote to memory of 2520 2040 cmd.exe 34 PID 2040 wrote to memory of 2520 2040 cmd.exe 34 PID 2040 wrote to memory of 2520 2040 cmd.exe 34 PID 2040 wrote to memory of 2520 2040 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe"C:\Users\Admin\AppData\Local\Temp\5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2520
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exeC:\Users\Admin\AppData\Local\Temp\HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe2⤵
- Executes dropped EXE
PID:3040
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe
Filesize1.9MB
MD56974f64271903c5c6f10e842010b9668
SHA1fee0dd3e2ae960842c073fbfe4520daed35c558d
SHA25654916997730e872bf4694e537aea01f9974e9b21e8c116f65f40f847a5eb6605
SHA512228c484b22b7408a297e72461565a85232eb2b7b8de64cddd711185a07d502d001f2aa88f5d1eb1f2fb2d5b9dae36d4850375eee163f139d0dcf810a977bc2d4
-
Filesize
1.3MB
MD5a68be89e7d269501980fcd3ecfb2a8af
SHA129ed992e00d0641e1a5aea3f8b358fa39710f338
SHA25663a39a5a3d48fdaa1819c37b8ff0e7114ce7b98f1fa8b9ea94343a9f7d763b1c
SHA512914e22434272413a2af9f6c539331d3fdfc42b2f220ef546f5d13a640e6a5a9e0dabd836cbdae2012f710b57b27656f76eb901b5d8b38b94010b366130b73419
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
\Users\Admin\AppData\Local\Temp\HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe
Filesize1.9MB
MD56974f64271903c5c6f10e842010b9668
SHA1fee0dd3e2ae960842c073fbfe4520daed35c558d
SHA25654916997730e872bf4694e537aea01f9974e9b21e8c116f65f40f847a5eb6605
SHA512228c484b22b7408a297e72461565a85232eb2b7b8de64cddd711185a07d502d001f2aa88f5d1eb1f2fb2d5b9dae36d4850375eee163f139d0dcf810a977bc2d4
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c