Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1794s -
max time network
1797s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
15/03/2024, 05:39
General
-
Target
servercry.exe
-
Size
3.1MB
-
MD5
2d329dbfe6241b54920c60b62ebac68b
-
SHA1
6949cd11434102e727a8d7b90366b2f8e3bc0294
-
SHA256
1aa55dd42cd313b484eb75a4b5be092bb85e03a87492c41d826f6f694da6c7d8
-
SHA512
2a00f009d8273dd9bb90c3b6a4fc6a584a1094cb7ea0b2716a5523bdd10c60c31174ced87522b17521ef8faef73b5cc2311e499e03cbdc382a2034c5b8529af8
-
SSDEEP
49152:Ixm7FAEjpcMiuFOWaMXjZSK7C6jMrqITCYLVpoMeWTCULvufO2RrNJlXoC:VFAEjpcMXMrq0fLVpoMaCvu9RrTlXo
Malware Config
Signatures
-
ParallaxRat
ParallaxRat is a multipurpose RAT written in MASM.
-
ParallaxRat payload 36 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious behavior: SetClipboardViewer 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\servercry.exe"C:\Users\Admin\AppData\Local\Temp\servercry.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TrendMicro\TRX.exe"C:\Users\Admin\AppData\Roaming\TrendMicro\TRX.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD52d329dbfe6241b54920c60b62ebac68b
SHA16949cd11434102e727a8d7b90366b2f8e3bc0294
SHA2561aa55dd42cd313b484eb75a4b5be092bb85e03a87492c41d826f6f694da6c7d8
SHA5122a00f009d8273dd9bb90c3b6a4fc6a584a1094cb7ea0b2716a5523bdd10c60c31174ced87522b17521ef8faef73b5cc2311e499e03cbdc382a2034c5b8529af8
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
3.3MB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
512KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
512KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
3.3MB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
512KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
512KB