Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/02/2024, 15:16
General
-
Target
sew1.exe
-
Size
1.9MB
-
MD5
6c5843a7b8b23ce49dbd3d89a54b56bf
-
SHA1
afc9a7160ad753b2fedc385f2544d1d98cebf0be
-
SHA256
f6c901d8959b26428c5fbb9b0c4a18be2057bb4d22e85bfe2442c0a8744a9ff6
-
SHA512
5322db20006ce6a0ef58470f05b091a10147a57c467ae38eec813b37740decd01c18fe906262146b21e5703b5c902ebf64a0c035487120ce30863fb438d89c08
-
SSDEEP
24576:syc92Stiatqme6qnvKEOQmSgcetFtABdSCSuWyLZ6gpEVKAlYE1W1:B5jJvHgJtALSCSuZVsTlM
Malware Config
Signatures
-
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
-
ParallaxRat payload 18 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
-
Drops startup file 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sew1.exe"C:\Users\Admin\AppData\Local\Temp\sew1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
176KB