Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 21:28
Static task
static1
Behavioral task
behavioral1
Sample
bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe
Resource
win10v2004-20230915-en
General
-
Target
bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe
-
Size
955KB
-
MD5
43300528f352509302e289669403ded9
-
SHA1
a6644b5bed8ec405af2e0fc2a2dec86acffa4da3
-
SHA256
bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88
-
SHA512
3573586ac4fbc1114a17395d046843d9e31fa5005fee4bc2c9041f03281dc05858b9c93d4728135a91902f5f3d4bbc499c5a7c806e73ddce82397942eaee5562
-
SSDEEP
24576:ZnRoUWPkfjHFMlfph5qXxtw7AWYGQMJG1hVMgjBS6Z2sj8J6mOo4fL:ZmbkjH2vgh8joh7jBS6Z2084TooL
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/memory/2776-53-0x0000000010000000-0x0000000010042000-memory.dmp family_gh0strat behavioral1/memory/1632-151-0x0000000010000000-0x0000000010042000-memory.dmp family_gh0strat -
Fatal Rat payload 2 IoCs
resource yara_rule behavioral1/memory/2776-53-0x0000000010000000-0x0000000010042000-memory.dmp fatalrat behavioral1/memory/1632-151-0x0000000010000000-0x0000000010042000-memory.dmp fatalrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe -
Executes dropped EXE 1 IoCs
pid Process 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Wine bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Wine bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe -
Loads dropped DLL 1 IoCs
pid Process 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 2628 powershell.exe 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 1516 powershell.exe 528 powershell.exe 1716 powershell.exe 744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2628 powershell.exe Token: SeDebugPrivilege 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeDebugPrivilege 528 powershell.exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 744 powershell.exe Token: SeDebugPrivilege 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2756 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 30 PID 2776 wrote to memory of 2756 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 30 PID 2776 wrote to memory of 2756 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 30 PID 2776 wrote to memory of 2756 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 30 PID 2776 wrote to memory of 2692 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 32 PID 2776 wrote to memory of 2692 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 32 PID 2776 wrote to memory of 2692 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 32 PID 2776 wrote to memory of 2692 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 32 PID 2776 wrote to memory of 2292 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 34 PID 2776 wrote to memory of 2292 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 34 PID 2776 wrote to memory of 2292 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 34 PID 2776 wrote to memory of 2292 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 34 PID 2776 wrote to memory of 2628 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 36 PID 2776 wrote to memory of 2628 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 36 PID 2776 wrote to memory of 2628 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 36 PID 2776 wrote to memory of 2628 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 36 PID 2776 wrote to memory of 1632 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 38 PID 2776 wrote to memory of 1632 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 38 PID 2776 wrote to memory of 1632 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 38 PID 2776 wrote to memory of 1632 2776 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 38 PID 1632 wrote to memory of 1516 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 39 PID 1632 wrote to memory of 1516 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 39 PID 1632 wrote to memory of 1516 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 39 PID 1632 wrote to memory of 1516 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 39 PID 1632 wrote to memory of 528 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 41 PID 1632 wrote to memory of 528 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 41 PID 1632 wrote to memory of 528 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 41 PID 1632 wrote to memory of 528 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 41 PID 1632 wrote to memory of 1716 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 43 PID 1632 wrote to memory of 1716 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 43 PID 1632 wrote to memory of 1716 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 43 PID 1632 wrote to memory of 1716 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 43 PID 1632 wrote to memory of 744 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 46 PID 1632 wrote to memory of 744 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 46 PID 1632 wrote to memory of 744 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 46 PID 1632 wrote to memory of 744 1632 bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe"C:\Users\Admin\AppData\Local\Temp\bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell2⤵PID:2756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command -2⤵PID:2692
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell2⤵PID:2292
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Users\Admin\AppData\Local\bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe"C:\Users\Admin\AppData\Local\bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command -3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command -3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
955KB
MD543300528f352509302e289669403ded9
SHA1a6644b5bed8ec405af2e0fc2a2dec86acffa4da3
SHA256bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88
SHA5123573586ac4fbc1114a17395d046843d9e31fa5005fee4bc2c9041f03281dc05858b9c93d4728135a91902f5f3d4bbc499c5a7c806e73ddce82397942eaee5562
-
Filesize
955KB
MD543300528f352509302e289669403ded9
SHA1a6644b5bed8ec405af2e0fc2a2dec86acffa4da3
SHA256bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88
SHA5123573586ac4fbc1114a17395d046843d9e31fa5005fee4bc2c9041f03281dc05858b9c93d4728135a91902f5f3d4bbc499c5a7c806e73ddce82397942eaee5562
-
Filesize
955KB
MD543300528f352509302e289669403ded9
SHA1a6644b5bed8ec405af2e0fc2a2dec86acffa4da3
SHA256bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88
SHA5123573586ac4fbc1114a17395d046843d9e31fa5005fee4bc2c9041f03281dc05858b9c93d4728135a91902f5f3d4bbc499c5a7c806e73ddce82397942eaee5562
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IT6OZBP3YTKYFU8L07PB.temp
Filesize7KB
MD56ca58d44a0aab6a5f173f523d91faa39
SHA1d9785f550b3caec6930d5d57bf9a7d9a45d547c7
SHA2568331f289de81ec372307b16dd151b5d240d6139e52098ddd7f06884e065a0a29
SHA5128684fb10771fb314e0b7badaf30fe30a6aa98953c28c0689911cba1167a948e64abc42e2fd5f2fced48d331d5f62f2f3eb83b3b545c0e83a25062134cefffb12
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD56ca58d44a0aab6a5f173f523d91faa39
SHA1d9785f550b3caec6930d5d57bf9a7d9a45d547c7
SHA2568331f289de81ec372307b16dd151b5d240d6139e52098ddd7f06884e065a0a29
SHA5128684fb10771fb314e0b7badaf30fe30a6aa98953c28c0689911cba1167a948e64abc42e2fd5f2fced48d331d5f62f2f3eb83b3b545c0e83a25062134cefffb12
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD56ca58d44a0aab6a5f173f523d91faa39
SHA1d9785f550b3caec6930d5d57bf9a7d9a45d547c7
SHA2568331f289de81ec372307b16dd151b5d240d6139e52098ddd7f06884e065a0a29
SHA5128684fb10771fb314e0b7badaf30fe30a6aa98953c28c0689911cba1167a948e64abc42e2fd5f2fced48d331d5f62f2f3eb83b3b545c0e83a25062134cefffb12
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD56ca58d44a0aab6a5f173f523d91faa39
SHA1d9785f550b3caec6930d5d57bf9a7d9a45d547c7
SHA2568331f289de81ec372307b16dd151b5d240d6139e52098ddd7f06884e065a0a29
SHA5128684fb10771fb314e0b7badaf30fe30a6aa98953c28c0689911cba1167a948e64abc42e2fd5f2fced48d331d5f62f2f3eb83b3b545c0e83a25062134cefffb12
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD569e0f40be5aa7dd7c300c4ecdf025e4c
SHA157c75998ce732bf6ef7171fa40d17f97703678d5
SHA256e353a2a3d0e41af69cbcb28c989b40c63d0f57f82a0ff408659253aa239ffe38
SHA512eb859e3aea41c0a6776379bb847b26824e79a759b31ca77f86bc547fcea87df8f9d0f6348d16ba8603b5c967df6787146dec74f5fa1c23501c164419deb82445
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD569e0f40be5aa7dd7c300c4ecdf025e4c
SHA157c75998ce732bf6ef7171fa40d17f97703678d5
SHA256e353a2a3d0e41af69cbcb28c989b40c63d0f57f82a0ff408659253aa239ffe38
SHA512eb859e3aea41c0a6776379bb847b26824e79a759b31ca77f86bc547fcea87df8f9d0f6348d16ba8603b5c967df6787146dec74f5fa1c23501c164419deb82445
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD569e0f40be5aa7dd7c300c4ecdf025e4c
SHA157c75998ce732bf6ef7171fa40d17f97703678d5
SHA256e353a2a3d0e41af69cbcb28c989b40c63d0f57f82a0ff408659253aa239ffe38
SHA512eb859e3aea41c0a6776379bb847b26824e79a759b31ca77f86bc547fcea87df8f9d0f6348d16ba8603b5c967df6787146dec74f5fa1c23501c164419deb82445
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD569e0f40be5aa7dd7c300c4ecdf025e4c
SHA157c75998ce732bf6ef7171fa40d17f97703678d5
SHA256e353a2a3d0e41af69cbcb28c989b40c63d0f57f82a0ff408659253aa239ffe38
SHA512eb859e3aea41c0a6776379bb847b26824e79a759b31ca77f86bc547fcea87df8f9d0f6348d16ba8603b5c967df6787146dec74f5fa1c23501c164419deb82445
-
Filesize
955KB
MD543300528f352509302e289669403ded9
SHA1a6644b5bed8ec405af2e0fc2a2dec86acffa4da3
SHA256bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88
SHA5123573586ac4fbc1114a17395d046843d9e31fa5005fee4bc2c9041f03281dc05858b9c93d4728135a91902f5f3d4bbc499c5a7c806e73ddce82397942eaee5562
-
Filesize
955KB
MD543300528f352509302e289669403ded9
SHA1a6644b5bed8ec405af2e0fc2a2dec86acffa4da3
SHA256bb4985dd9ac7d1165ea3efa792353e2131226de3d726e1197c83272fb46d8c88
SHA5123573586ac4fbc1114a17395d046843d9e31fa5005fee4bc2c9041f03281dc05858b9c93d4728135a91902f5f3d4bbc499c5a7c806e73ddce82397942eaee5562