Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
31/10/2023, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
09 NOTIFICACION DEMANDA JUDICIAL/09 NOTIFICACION DEMANDA JUDICIAL....exe
Resource
win7-20231020-en
General
-
Target
09 NOTIFICACION DEMANDA JUDICIAL/09 NOTIFICACION DEMANDA JUDICIAL....exe
-
Size
658KB
-
MD5
ab63396cb0774ac41107b7b112f81d5a
-
SHA1
f5dc67429147e886b01413472496576a2ee34075
-
SHA256
9a43c57f3e98bd69789e8ccbeef2c1b6b5a3b1d06d63257bb4bd58dffa23689d
-
SHA512
2121961ae2b154ba941af6937d0522505ec7e323094fb2edc7058194ae958bcf866bbbc7842924236b8635917800d0708eaabff6112f131f496189bb6e021699
-
SSDEEP
12288:BKwp3N7HPqUeL31VI1kR8BgrsEofzwHJem7OzwHJe0IhfiZ:swp97HyUeLFVIuRCgrsEorwpemIwpels
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Clientes
enviofinal.kozow.com:5051
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
System.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2768-86-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 764 set thread context of 2708 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 27 PID 2708 set thread context of 2768 2708 cmd.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 2708 cmd.exe 2708 cmd.exe 2768 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 2708 cmd.exe 2708 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2768 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2768 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 764 wrote to memory of 2708 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 27 PID 764 wrote to memory of 2708 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 27 PID 764 wrote to memory of 2708 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 27 PID 764 wrote to memory of 2708 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 27 PID 764 wrote to memory of 2708 764 09 NOTIFICACION DEMANDA JUDICIAL....exe 27 PID 2708 wrote to memory of 2768 2708 cmd.exe 31 PID 2708 wrote to memory of 2768 2708 cmd.exe 31 PID 2708 wrote to memory of 2768 2708 cmd.exe 31 PID 2708 wrote to memory of 2768 2708 cmd.exe 31 PID 2708 wrote to memory of 2768 2708 cmd.exe 31 PID 2708 wrote to memory of 2768 2708 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\09 NOTIFICACION DEMANDA JUDICIAL\09 NOTIFICACION DEMANDA JUDICIAL....exe"C:\Users\Admin\AppData\Local\Temp\09 NOTIFICACION DEMANDA JUDICIAL\09 NOTIFICACION DEMANDA JUDICIAL....exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
638KB
MD53795d2eef4bb3b5afa1ab68510b15d13
SHA167913cbf6047dcb411b7a4e5d9d16ad32f9c08f3
SHA25636e1b3811060375f5b55723e27f578d929605f0de0f43915f7fb1eefe4820eba
SHA512f62027304d81ae23089c44d3f9afafd3b52cb1e6579ceb351f3584371505cb7335b785f7a44de0a1f5b99fb27abae5226a8a9c8795873929e7bf5b24ed59aefc
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9