Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2023, 08:19
Static task
static1
Behavioral task
behavioral1
Sample
2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe
Resource
win7-20230831-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe
-
Size
1.2MB
-
MD5
96626a498a8ee503abd98cc7c641c1b5
-
SHA1
68cb59e4dce54ba6ca33db94f8e337ae11a35249
-
SHA256
2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639
-
SHA512
f88d44dcf52536f6888a322cd1626f92a269298a594cf022211d3972267ee0420d093ce6c421f8f73f68784bcb557f8f46d463a690e9780a1869d72cfb1edfbc
-
SSDEEP
24576:GFQIVQ+dn+bNoHdgUzuiw5Jpnrw4qjGib9JHslg9Nyhl7RLp5aKVgKIOL5:ZIi+dn+bUWwuiw5JpnU4cB9nNWJxp4KB
Score
10/10
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 5 IoCs
resource yara_rule behavioral2/memory/2936-13076-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral2/memory/2936-17611-0x0000000000400000-0x0000000000573000-memory.dmp fatalrat behavioral2/memory/2936-26167-0x0000000000400000-0x0000000000573000-memory.dmp fatalrat behavioral2/memory/3980-30831-0x0000000000400000-0x0000000000573000-memory.dmp fatalrat behavioral2/memory/3004-39252-0x0000000000400000-0x0000000000573000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 3980 Jklmno.exe 3004 Jklmno.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jklmno.exe Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache Jklmno.exe File created C:\Windows\SysWOW64\Jklmno.exe 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475 Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_BF731B9C0C82CCD069EEBB7C6DE19E59 Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 Jklmno.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getip[1].htm Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_BF731B9C0C82CCD069EEBB7C6DE19E59 Jklmno.exe File opened for modification C:\Windows\SysWOW64\Jklmno.exe 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe File opened for modification C:\Windows\SysWOW64\Jklmno.exe Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData Jklmno.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content Jklmno.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 59 IoCs
pid Process 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 3980 Jklmno.exe 3980 Jklmno.exe 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe 3980 Jklmno.exe 3980 Jklmno.exe 3980 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe 3004 Jklmno.exe 3980 Jklmno.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jklmno.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Jklmno.exe -
Modifies data under HKEY_USERS 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Jklmno Qrstuvwx\InstallTime = "2023-10-19 08:20" Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Jklmno Qrstuvwx Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Jklmno Qrstuvwx\Group = "Fatal" Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion Jklmno.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe 3004 Jklmno.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2936 2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe Token: SeDebugPrivilege 3980 Jklmno.exe Token: SeDebugPrivilege 3004 Jklmno.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3004 3980 Jklmno.exe 92 PID 3980 wrote to memory of 3004 3980 Jklmno.exe 92 PID 3980 wrote to memory of 3004 3980 Jklmno.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe"C:\Users\Admin\AppData\Local\Temp\2c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
C:\Windows\SysWOW64\Jklmno.exeC:\Windows\SysWOW64\Jklmno.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\Jklmno.exeC:\Windows\SysWOW64\Jklmno.exe Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD596626a498a8ee503abd98cc7c641c1b5
SHA168cb59e4dce54ba6ca33db94f8e337ae11a35249
SHA2562c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639
SHA512f88d44dcf52536f6888a322cd1626f92a269298a594cf022211d3972267ee0420d093ce6c421f8f73f68784bcb557f8f46d463a690e9780a1869d72cfb1edfbc
-
Filesize
1.2MB
MD596626a498a8ee503abd98cc7c641c1b5
SHA168cb59e4dce54ba6ca33db94f8e337ae11a35249
SHA2562c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639
SHA512f88d44dcf52536f6888a322cd1626f92a269298a594cf022211d3972267ee0420d093ce6c421f8f73f68784bcb557f8f46d463a690e9780a1869d72cfb1edfbc
-
Filesize
1.2MB
MD596626a498a8ee503abd98cc7c641c1b5
SHA168cb59e4dce54ba6ca33db94f8e337ae11a35249
SHA2562c0981a3ceee83e83747c381986448ac06bad949bd756bc43264e4fddd914639
SHA512f88d44dcf52536f6888a322cd1626f92a269298a594cf022211d3972267ee0420d093ce6c421f8f73f68784bcb557f8f46d463a690e9780a1869d72cfb1edfbc