Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 11:43
Behavioral task
behavioral1
Sample
8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe
Resource
win7-20231215-en
General
-
Target
8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe
-
Size
539KB
-
MD5
f2d86e6703e7706174e887936571d7d4
-
SHA1
1f2377bd479e7fe584cbab253b29b37d4f767b36
-
SHA256
8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825
-
SHA512
9d7bdf72a52c4041469c9380d9a7d8c29d21a05e64710547c2d542991a1356a7c10cc4a429d753e772b571fb884b5687b70b3eb94ee7ceb403df30f13f73341e
-
SSDEEP
12288:NhymnwJFPNdgBAEHApqePJN1AmLM7uVq9sSAL:NUmwrl2Ao7sJNlM7ymsSA
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1996-0-0x0000000000400000-0x0000000000547000-memory.dmp purplefox_rootkit behavioral1/memory/1996-1-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/1996-20-0x0000000000400000-0x0000000000547000-memory.dmp purplefox_rootkit behavioral1/memory/3028-22-0x0000000000400000-0x0000000000547000-memory.dmp purplefox_rootkit behavioral1/memory/2780-38-0x0000000000400000-0x0000000000547000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 6 IoCs
resource yara_rule behavioral1/memory/1996-0-0x0000000000400000-0x0000000000547000-memory.dmp family_gh0strat behavioral1/memory/1996-1-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/3028-10-0x0000000000400000-0x0000000000547000-memory.dmp family_gh0strat behavioral1/memory/1996-20-0x0000000000400000-0x0000000000547000-memory.dmp family_gh0strat behavioral1/memory/3028-22-0x0000000000400000-0x0000000000547000-memory.dmp family_gh0strat behavioral1/memory/2780-38-0x0000000000400000-0x0000000000547000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Wxypq.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Wxypq.exe -
Deletes itself 1 IoCs
pid Process 2756 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 3028 Wxypq.exe 2780 Wxypq.exe -
Loads dropped DLL 1 IoCs
pid Process 3028 Wxypq.exe -
resource yara_rule behavioral1/memory/1996-0-0x0000000000400000-0x0000000000547000-memory.dmp upx behavioral1/files/0x000d0000000122f3-9.dat upx behavioral1/memory/3028-10-0x0000000000400000-0x0000000000547000-memory.dmp upx behavioral1/memory/1996-20-0x0000000000400000-0x0000000000547000-memory.dmp upx behavioral1/memory/2780-21-0x0000000000400000-0x0000000000547000-memory.dmp upx behavioral1/memory/3028-22-0x0000000000400000-0x0000000000547000-memory.dmp upx behavioral1/memory/2780-38-0x0000000000400000-0x0000000000547000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\AppPatch\Wxypq.exe 8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe File created C:\Program Files (x86)\AppPatch\Wxypq.exe 8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe -
Modifies data under HKEY_USERS 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Wxypq.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Wxypq.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Wxypq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Wxypq.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2344 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2780 Wxypq.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1996 8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe Token: SeLoadDriverPrivilege 2780 Wxypq.exe Token: 33 2780 Wxypq.exe Token: SeIncBasePriorityPrivilege 2780 Wxypq.exe Token: 33 2780 Wxypq.exe Token: SeIncBasePriorityPrivilege 2780 Wxypq.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2780 3028 Wxypq.exe 30 PID 3028 wrote to memory of 2780 3028 Wxypq.exe 30 PID 3028 wrote to memory of 2780 3028 Wxypq.exe 30 PID 3028 wrote to memory of 2780 3028 Wxypq.exe 30 PID 1996 wrote to memory of 2756 1996 8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe 29 PID 1996 wrote to memory of 2756 1996 8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe 29 PID 1996 wrote to memory of 2756 1996 8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe 29 PID 1996 wrote to memory of 2756 1996 8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe 29 PID 2756 wrote to memory of 2344 2756 cmd.exe 32 PID 2756 wrote to memory of 2344 2756 cmd.exe 32 PID 2756 wrote to memory of 2344 2756 cmd.exe 32 PID 2756 wrote to memory of 2344 2756 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe"C:\Users\Admin\AppData\Local\Temp\8c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\8C3851~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2344
-
-
-
C:\Program Files (x86)\AppPatch\Wxypq.exe"C:\Program Files (x86)\AppPatch\Wxypq.exe" -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\AppPatch\Wxypq.exe"C:\Program Files (x86)\AppPatch\Wxypq.exe" -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539KB
MD5f2d86e6703e7706174e887936571d7d4
SHA11f2377bd479e7fe584cbab253b29b37d4f767b36
SHA2568c385106f2acdb5958abc3b808e540d162fe9c8f4a7d3c35f2f03bdde5c52825
SHA5129d7bdf72a52c4041469c9380d9a7d8c29d21a05e64710547c2d542991a1356a7c10cc4a429d753e772b571fb884b5687b70b3eb94ee7ceb403df30f13f73341e