Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 18:04

General

  • Target

    87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe

  • Size

    69KB

  • MD5

    1bcc48211ca31660a585b931eb987f93

  • SHA1

    6633d480598a27f756a8ce706e4392b294ccc8ec

  • SHA256

    87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347

  • SHA512

    7704148f1e83bf97e8a6ff7f36b7fc56dee6a2175be55f1c8c9a2629a66d4d19635bfa03a7f4c92b7cbf4fbd27b014a2a2fa58dcc734fd560dab0a9977b3cf86

  • SSDEEP

    1536:Ju4n9Tswb2ksLtF3buXSumtVoGB7dTxYIbdS6w:Ju49Tswb2VLtF3bugbhJxYIbML

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

94.156.68.217:3162

Mutex

sz1D8OiE4OiM

Attributes
  • delay

    3

  • install

    true

  • install_file

    MicrosoftCompabilityTelemtry.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • UAC bypass 3 TTPs 1 IoCs
  • Async RAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe
    "C:\Users\Admin\AppData\Local\Temp\87e382fef7c2e0010af6532600c22578d26d041a78a1c3ec16dbf0d5eb39f347.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe
      "C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "MicrosoftCompabilityTelemtry" /tr '"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "MicrosoftCompabilityTelemtry" /tr '"C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:2056
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA454.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:432
        • C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe
          "C:\Users\Admin\AppData\Roaming\MicrosoftCompabilityTelemtry.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3912
    • C:\Users\Admin\AppData\Local\Temp\svchosts.exe
      "C:\Users\Admin\AppData\Local\Temp\svchosts.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1952
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\,C:\Users\Admin\AppData\Roaming
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\,C:\Users\Admin\AppData\Roaming
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4028
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C schtasks /create /tn svchosts /tr C:\Users\Admin\AppData\Roaming\svchosts.exe /sc onlogon
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn svchosts /tr C:\Users\Admin\AppData\Roaming\svchosts.exe /sc onlogon
          4⤵
          • Creates scheduled task(s)
          PID:3016
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2200

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MicrosoftCompabilityTelemtry.exe.log

      Filesize

      522B

      MD5

      acc9090417037dfa2a55b46ed86e32b8

      SHA1

      53fa6fb25fb3e88c24d2027aca6ae492b2800a4d

      SHA256

      2412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b

      SHA512

      d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b

    • C:\Users\Admin\AppData\Local\Temp\MicrosoftCompabilityTelemtry.exe

      Filesize

      45KB

      MD5

      fee8e7725f89e5b99e165996d89e0d29

      SHA1

      827fe03932f7c557703f62b4eec683eb1a14b9c2

      SHA256

      b56464ef35b43d5e04a3fe655c2e80567fa67acb396221357b852e04952d0809

      SHA512

      11adb2c2320c21848ecca24cc542a17fc7bf80e74ef54b4f7e1ec088af5614ad04db64ab3ae1b9a8bf7106aaa6355a8ef686b4839a5756405b76425edcf6685e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bb0knvz1.1vz.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\svchosts.exe

      Filesize

      12KB

      MD5

      0ade14069ec4dafe0f02c419da0f9ddd

      SHA1

      01fce38588ec0cbb6d17be718ba5867551180e32

      SHA256

      7df0b72ac5875dc5025d2f1e8d1eaa2cac1a4c58f2289603c852d2f9e191c948

      SHA512

      43e448d4bf3e25d6b154bf98da25dc183404ff35515029570f4554fa048d14ef208c4a8c7ac1024718abbb96c73c3e94ca8c5bcf8f8e8852c152b8c13959c92e

    • C:\Users\Admin\AppData\Local\Temp\tmpA454.tmp.bat

      Filesize

      172B

      MD5

      518409fe904cd51efdc80b5cd5f53252

      SHA1

      af6653d252621349c87346ee54f4d58693fb07bb

      SHA256

      b3d15d611493c88fb6c59dd5e77d7dfde530b338304b1769642face1a20b7cf5

      SHA512

      0f2663a9489bb83f8ce98715d946554e646f410be36007103fc1753e09678fbc84c8c93eb10bad13c716e3b1a4c463f51464351e209d2dd14bf8434aad8cd0df

    • memory/1952-31-0x0000000004B60000-0x0000000004BF2000-memory.dmp

      Filesize

      584KB

    • memory/1952-39-0x0000000004D40000-0x0000000004D50000-memory.dmp

      Filesize

      64KB

    • memory/1952-41-0x0000000004D40000-0x0000000004D50000-memory.dmp

      Filesize

      64KB

    • memory/1952-29-0x0000000000170000-0x000000000017A000-memory.dmp

      Filesize

      40KB

    • memory/1952-30-0x0000000005020000-0x00000000055C4000-memory.dmp

      Filesize

      5.6MB

    • memory/1952-27-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/1952-58-0x0000000004D40000-0x0000000004D50000-memory.dmp

      Filesize

      64KB

    • memory/1952-36-0x0000000004C20000-0x0000000004C2A000-memory.dmp

      Filesize

      40KB

    • memory/1952-34-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/1952-35-0x0000000004D40000-0x0000000004D50000-memory.dmp

      Filesize

      64KB

    • memory/2992-0-0x0000000000100000-0x0000000000116000-memory.dmp

      Filesize

      88KB

    • memory/2992-1-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/2992-23-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmp

      Filesize

      10.8MB

    • memory/3912-62-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/3912-66-0x0000000003370000-0x0000000003380000-memory.dmp

      Filesize

      64KB

    • memory/3912-56-0x0000000003370000-0x0000000003380000-memory.dmp

      Filesize

      64KB

    • memory/3912-55-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4028-48-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

    • memory/4028-64-0x00000000053C0000-0x0000000005426000-memory.dmp

      Filesize

      408KB

    • memory/4028-76-0x0000000005690000-0x00000000059E4000-memory.dmp

      Filesize

      3.3MB

    • memory/4028-47-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4028-65-0x0000000005520000-0x0000000005586000-memory.dmp

      Filesize

      408KB

    • memory/4028-49-0x00000000025F0000-0x0000000002626000-memory.dmp

      Filesize

      216KB

    • memory/4028-57-0x0000000004D90000-0x00000000053B8000-memory.dmp

      Filesize

      6.2MB

    • memory/4028-63-0x0000000004CE0000-0x0000000004D02000-memory.dmp

      Filesize

      136KB

    • memory/4028-59-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4028-60-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

    • memory/4028-61-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

    • memory/4288-33-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4288-37-0x0000000005E70000-0x0000000005F0C000-memory.dmp

      Filesize

      624KB

    • memory/4288-38-0x0000000005980000-0x0000000005990000-memory.dmp

      Filesize

      64KB

    • memory/4288-26-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB

    • memory/4288-32-0x0000000005980000-0x0000000005990000-memory.dmp

      Filesize

      64KB

    • memory/4288-28-0x0000000000F20000-0x0000000000F32000-memory.dmp

      Filesize

      72KB

    • memory/4288-50-0x00000000747C0000-0x0000000074F70000-memory.dmp

      Filesize

      7.7MB