Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
26/10/2023, 10:21
Behavioral task
behavioral1
Sample
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe
Resource
win10v2004-20231023-en
General
-
Target
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe
-
Size
250KB
-
MD5
2acae995c467fa7dcca1824fe0b7cc51
-
SHA1
68f5813e3e77e43a56755906bf021a319b06c945
-
SHA256
3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1
-
SHA512
f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15
-
SSDEEP
6144:0F5fd4mw5FFUSd+pIR6byxMGPxF/WAV54XQ:0FpCmwJUtpIEbyGGPxuXQ
Malware Config
Signatures
-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload 4 IoCs
resource yara_rule behavioral1/memory/1412-1-0x0000000010000000-0x000000001002A000-memory.dmp fatalrat behavioral1/memory/1412-23-0x0000000000400000-0x00000000004A8000-memory.dmp fatalrat behavioral1/memory/1684-24-0x0000000000400000-0x00000000004A8000-memory.dmp fatalrat behavioral1/memory/3052-26-0x0000000000400000-0x00000000004A8000-memory.dmp fatalrat -
Executes dropped EXE 2 IoCs
pid Process 1684 Jklmno.exe 3052 Jklmno.exe -
Loads dropped DLL 1 IoCs
pid Process 1684 Jklmno.exe -
resource yara_rule behavioral1/memory/1412-0-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral1/files/0x00060000000120e6-7.dat upx behavioral1/files/0x00060000000120e6-14.dat upx behavioral1/memory/3052-17-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral1/files/0x00060000000120e6-16.dat upx behavioral1/files/0x00060000000120e6-13.dat upx behavioral1/memory/1412-23-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral1/memory/1684-24-0x0000000000400000-0x00000000004A8000-memory.dmp upx behavioral1/memory/3052-26-0x0000000000400000-0x00000000004A8000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Jklmno.exe 3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe File opened for modification C:\Windows\SysWOW64\Jklmno.exe Jklmno.exe File created C:\Windows\SysWOW64\Jklmno.exe Jklmno.exe File created C:\Windows\SysWOW64\Jklmno.exe 3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe -
Modifies data under HKEY_USERS 16 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx\Group = "Fatal" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx\InstallTime = "2023-10-26 10:22" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Jklmno.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1412 3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1412 3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe Token: SeDebugPrivilege 1684 Jklmno.exe Token: SeDebugPrivilege 3052 Jklmno.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1684 wrote to memory of 3052 1684 Jklmno.exe 29 PID 1684 wrote to memory of 3052 1684 Jklmno.exe 29 PID 1684 wrote to memory of 3052 1684 Jklmno.exe 29 PID 1684 wrote to memory of 3052 1684 Jklmno.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe"C:\Users\Admin\AppData\Local\Temp\3c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
C:\Windows\SysWOW64\Jklmno.exeC:\Windows\SysWOW64\Jklmno.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\Jklmno.exeC:\Windows\SysWOW64\Jklmno.exe Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD52acae995c467fa7dcca1824fe0b7cc51
SHA168f5813e3e77e43a56755906bf021a319b06c945
SHA2563c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1
SHA512f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15
-
Filesize
250KB
MD52acae995c467fa7dcca1824fe0b7cc51
SHA168f5813e3e77e43a56755906bf021a319b06c945
SHA2563c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1
SHA512f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15
-
Filesize
250KB
MD52acae995c467fa7dcca1824fe0b7cc51
SHA168f5813e3e77e43a56755906bf021a319b06c945
SHA2563c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1
SHA512f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15
-
Filesize
250KB
MD52acae995c467fa7dcca1824fe0b7cc51
SHA168f5813e3e77e43a56755906bf021a319b06c945
SHA2563c4fed4d32c4a23562e70d8408140a0706342682e7769a89bb49a2d84f5482e1
SHA512f8ad29436f85015ee6b9db655c8d341b587fae088352a2707f0289e0f6667161753a2a5ba24483eb5618aa9a7732c95b2114bcdc6a308beae8d3f4cb5a171e15