Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
09 NOTIFICACION DEMANDA JUDICIAL/09 NOTIFICACION DEMANDA JUDICIAL....exe
Resource
win7-20231020-en
General
-
Target
09 NOTIFICACION DEMANDA JUDICIAL/09 NOTIFICACION DEMANDA JUDICIAL....exe
-
Size
658KB
-
MD5
ab63396cb0774ac41107b7b112f81d5a
-
SHA1
f5dc67429147e886b01413472496576a2ee34075
-
SHA256
9a43c57f3e98bd69789e8ccbeef2c1b6b5a3b1d06d63257bb4bd58dffa23689d
-
SHA512
2121961ae2b154ba941af6937d0522505ec7e323094fb2edc7058194ae958bcf866bbbc7842924236b8635917800d0708eaabff6112f131f496189bb6e021699
-
SSDEEP
12288:BKwp3N7HPqUeL31VI1kR8BgrsEofzwHJem7OzwHJe0IhfiZ:swp97HyUeLFVIuRCgrsEorwpemIwpels
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Clientes
enviofinal.kozow.com:5051
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
System.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3372-42-0x00000000005C0000-0x00000000005D6000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3228 set thread context of 4920 3228 09 NOTIFICACION DEMANDA JUDICIAL....exe 86 PID 4920 set thread context of 3372 4920 cmd.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3228 09 NOTIFICACION DEMANDA JUDICIAL....exe 4920 cmd.exe 4920 cmd.exe 3372 MSBuild.exe 3372 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3228 09 NOTIFICACION DEMANDA JUDICIAL....exe 4920 cmd.exe 4920 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3372 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3372 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3228 wrote to memory of 4920 3228 09 NOTIFICACION DEMANDA JUDICIAL....exe 86 PID 3228 wrote to memory of 4920 3228 09 NOTIFICACION DEMANDA JUDICIAL....exe 86 PID 3228 wrote to memory of 4920 3228 09 NOTIFICACION DEMANDA JUDICIAL....exe 86 PID 3228 wrote to memory of 4920 3228 09 NOTIFICACION DEMANDA JUDICIAL....exe 86 PID 4920 wrote to memory of 3372 4920 cmd.exe 101 PID 4920 wrote to memory of 3372 4920 cmd.exe 101 PID 4920 wrote to memory of 3372 4920 cmd.exe 101 PID 4920 wrote to memory of 3372 4920 cmd.exe 101 PID 4920 wrote to memory of 3372 4920 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\09 NOTIFICACION DEMANDA JUDICIAL\09 NOTIFICACION DEMANDA JUDICIAL....exe"C:\Users\Admin\AppData\Local\Temp\09 NOTIFICACION DEMANDA JUDICIAL\09 NOTIFICACION DEMANDA JUDICIAL....exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3372
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
638KB
MD5ac7fb768b4b0239b7789df357635bc6b
SHA1f97e032afe58b36b1c5a4cf81b25730628a2707e
SHA2561fe2cb3307412d28c8804b9df42625d6a1aefc487997a5caaa66403082cd0754
SHA5121321e2ff48d48e3113c9f732949ae510de6efab7dcb1b8f312ab0b75a4595fa87c3de26c3ede02e7ef41e7409d33b470c1cf8910a53e02f91588b19524be2705