Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2023, 03:03

General

  • Target

    出_票_单.exe

  • Size

    2.8MB

  • MD5

    fb5c3286d10602c46a2eda71f6dc9f80

  • SHA1

    55f35e2fec2c4dd7bb050b5559728f78e33b377c

  • SHA256

    b1b3d39b039dc591aeedda6195b5a8da9044e1bf4d574f471050447dba6a4ca2

  • SHA512

    4d0e4ba8b45811d8fbc723404a5a446d6337f43e4ef30f4afac6224aa030e70f63e82374c93bfd43c5932b5410a0ba71bd42d7c88d03d776af2fb4588a187fbf

  • SSDEEP

    49152:rLY5etGvnVEAjHWgYGe7dquNGAnOtNmpHdHEIyQrZX6uaMmSv/VcYpD/UVJ1BclU:40tGvnVhHWgYGoquNLnOtNmpHdk4X6ui

Malware Config

Signatures

  • FatalRat

    FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

  • Fatal Rat payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\出_票_单.exe
    "C:\Users\Admin\AppData\Local\Temp\出_票_单.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe
      "C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Users\Admin\AppData\Local\QQMicroGameBox.exe
        "C:\Users\Admin\AppData\Local\QQMicroGameBox.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe

    Filesize

    1.9MB

    MD5

    7f8f210a6f11a1e556b8dd7bb26e2e7d

    SHA1

    49a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1

    SHA256

    c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7

    SHA512

    1c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7

  • C:\Program Files (x86)\Application Verifier\QQMicroGameBox.exe

    Filesize

    1.9MB

    MD5

    7f8f210a6f11a1e556b8dd7bb26e2e7d

    SHA1

    49a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1

    SHA256

    c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7

    SHA512

    1c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7

  • C:\Program Files (x86)\Application Verifier\afd.bin

    Filesize

    198KB

    MD5

    8d7b75e76767e7d80ba2d7c5f012cd53

    SHA1

    a3b2f2dabc3ddd47d9c53b74202358136b23d2f9

    SHA256

    4afd5abe32b72232a25e44c88f5af96f182c9ce8d06f3aa44970e5366989af43

    SHA512

    d964016717b7fc4a9f443de9c85ec507d6c823b7616d8b51f31e5cacf992fd3519c170ea2cf14a88f0b3b17670871637a679807bf11f990d5e26eb00335feeb0

  • C:\Program Files (x86)\Application Verifier\sentry.dll

    Filesize

    41KB

    MD5

    80ecab1e6964fd8317a370c5afe6e701

    SHA1

    7243fa4607c5c7c8a055eb1351a4b02a24507013

    SHA256

    fb701b41656908d9e4b14a1f368809a6a5d8c80b365cecf5b07c5414cc55ce7b

    SHA512

    0cec55f9006a66035b61cd598961c85d70a84282b0c8cf093d197b0221862847505be39f8170cfe19a2a5ce6c961f2c40a60a3bc27a368ca9e3919f3487b9ac4

  • C:\Users\Admin\AppData\Local\QQMicroGameBox.exe

    Filesize

    1.9MB

    MD5

    7f8f210a6f11a1e556b8dd7bb26e2e7d

    SHA1

    49a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1

    SHA256

    c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7

    SHA512

    1c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7

  • C:\Users\Admin\AppData\Local\QQMicroGameBox.exe

    Filesize

    1.9MB

    MD5

    7f8f210a6f11a1e556b8dd7bb26e2e7d

    SHA1

    49a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1

    SHA256

    c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7

    SHA512

    1c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7

  • C:\Users\Admin\AppData\Local\QQMicroGameBox.exe

    Filesize

    1.9MB

    MD5

    7f8f210a6f11a1e556b8dd7bb26e2e7d

    SHA1

    49a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1

    SHA256

    c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7

    SHA512

    1c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7

  • \Program Files (x86)\Application Verifier\QQMicroGameBox.exe

    Filesize

    1.9MB

    MD5

    7f8f210a6f11a1e556b8dd7bb26e2e7d

    SHA1

    49a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1

    SHA256

    c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7

    SHA512

    1c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7

  • \Program Files (x86)\Application Verifier\sentry.dll

    Filesize

    41KB

    MD5

    80ecab1e6964fd8317a370c5afe6e701

    SHA1

    7243fa4607c5c7c8a055eb1351a4b02a24507013

    SHA256

    fb701b41656908d9e4b14a1f368809a6a5d8c80b365cecf5b07c5414cc55ce7b

    SHA512

    0cec55f9006a66035b61cd598961c85d70a84282b0c8cf093d197b0221862847505be39f8170cfe19a2a5ce6c961f2c40a60a3bc27a368ca9e3919f3487b9ac4

  • \Program Files (x86)\Application Verifier\sentry.dll

    Filesize

    41KB

    MD5

    80ecab1e6964fd8317a370c5afe6e701

    SHA1

    7243fa4607c5c7c8a055eb1351a4b02a24507013

    SHA256

    fb701b41656908d9e4b14a1f368809a6a5d8c80b365cecf5b07c5414cc55ce7b

    SHA512

    0cec55f9006a66035b61cd598961c85d70a84282b0c8cf093d197b0221862847505be39f8170cfe19a2a5ce6c961f2c40a60a3bc27a368ca9e3919f3487b9ac4

  • \Users\Admin\AppData\Local\QQMicroGameBox.exe

    Filesize

    1.9MB

    MD5

    7f8f210a6f11a1e556b8dd7bb26e2e7d

    SHA1

    49a1e7d58e43cc5e177de7857b8fa9c8a6f6d1c1

    SHA256

    c7109e87b0d20b842816f055a8714f0eebccfa99a031e6b7a472397736329af7

    SHA512

    1c414aa37879bed96a82a1d14658e58da6d085cd0a6d523a65780c9dc585d78afa99eefc64dc5d9961702dc5fdd8b647f9475eed25ef67287de01f82962921a7

  • memory/2400-41-0x0000000000140000-0x00000000001A4000-memory.dmp

    Filesize

    400KB

  • memory/2400-45-0x00000000001B0000-0x00000000001DA000-memory.dmp

    Filesize

    168KB

  • memory/2744-7-0x0000000010000000-0x0000000010022000-memory.dmp

    Filesize

    136KB

  • memory/2744-11-0x0000000000AD0000-0x0000000000B34000-memory.dmp

    Filesize

    400KB

  • memory/2772-26-0x0000000000A40000-0x0000000000A6A000-memory.dmp

    Filesize

    168KB

  • memory/2772-22-0x0000000000AD0000-0x0000000000B34000-memory.dmp

    Filesize

    400KB

  • memory/2772-21-0x0000000010000000-0x0000000010031000-memory.dmp

    Filesize

    196KB