Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe
Resource
win7-20230831-en
General
-
Target
5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe
-
Size
3.2MB
-
MD5
d18f878cd976e18f23b19c0a6809df06
-
SHA1
1a3a31612889de8d194289ff0d20be4e7373ff38
-
SHA256
5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9
-
SHA512
a1a3df4db86746f790be8b516559cdc4e30b82f677c0c97d8de532f761601497d4e581b25c61bd041fc170f347821a233a9088c37a1fbfdc39362364444fa4b3
-
SSDEEP
49152:p89XJt4HIZ/Gg0P+Wh81iWwV9wxTeIJtk5/IjTf5GelUXKerOmhis:OZJt4HIZOgmh8AvodLJtk/elc
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1964-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1964-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2208-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1964-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2024-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2024-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2024-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral2/memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1964-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1964-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2208-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1964-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2024-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2024-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2024-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 2208 QQ.exe 1964 TXPlatforn.exe 2024 TXPlatforn.exe 876 HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
resource yara_rule behavioral2/memory/2208-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2208-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2208-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1964-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1964-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1964-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2208-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1964-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2024-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2024-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2024-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3852 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2024 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2208 QQ.exe Token: SeLoadDriverPrivilege 2024 TXPlatforn.exe Token: 33 2024 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2024 TXPlatforn.exe Token: 33 2024 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2024 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2208 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 86 PID 1432 wrote to memory of 2208 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 86 PID 1432 wrote to memory of 2208 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 86 PID 2208 wrote to memory of 1120 2208 QQ.exe 88 PID 2208 wrote to memory of 1120 2208 QQ.exe 88 PID 2208 wrote to memory of 1120 2208 QQ.exe 88 PID 1964 wrote to memory of 2024 1964 TXPlatforn.exe 90 PID 1964 wrote to memory of 2024 1964 TXPlatforn.exe 90 PID 1964 wrote to memory of 2024 1964 TXPlatforn.exe 90 PID 1432 wrote to memory of 876 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 91 PID 1432 wrote to memory of 876 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 91 PID 1432 wrote to memory of 876 1432 5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe 91 PID 1120 wrote to memory of 3852 1120 cmd.exe 93 PID 1120 wrote to memory of 3852 1120 cmd.exe 93 PID 1120 wrote to memory of 3852 1120 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe"C:\Users\Admin\AppData\Local\Temp\5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3852
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exeC:\Users\Admin\AppData\Local\Temp\HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe2⤵
- Executes dropped EXE
PID:876
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9.exe
Filesize1.9MB
MD56974f64271903c5c6f10e842010b9668
SHA1fee0dd3e2ae960842c073fbfe4520daed35c558d
SHA25654916997730e872bf4694e537aea01f9974e9b21e8c116f65f40f847a5eb6605
SHA512228c484b22b7408a297e72461565a85232eb2b7b8de64cddd711185a07d502d001f2aa88f5d1eb1f2fb2d5b9dae36d4850375eee163f139d0dcf810a977bc2d4
-
Filesize
1.3MB
MD5a68be89e7d269501980fcd3ecfb2a8af
SHA129ed992e00d0641e1a5aea3f8b358fa39710f338
SHA25663a39a5a3d48fdaa1819c37b8ff0e7114ce7b98f1fa8b9ea94343a9f7d763b1c
SHA512914e22434272413a2af9f6c539331d3fdfc42b2f220ef546f5d13a640e6a5a9e0dabd836cbdae2012f710b57b27656f76eb901b5d8b38b94010b366130b73419
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c