Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/04/2024, 20:56

General

  • Target

    C11Bootstrapper/Properties/IndependenciesInstallation.bat

  • Size

    489B

  • MD5

    d8da01fb6f6288b044868f85228cbb10

  • SHA1

    9d08c813ce59ab863c6ec3c68c336eed265c5e8a

  • SHA256

    74416d022dde876ff622038a6359907da239bbd26ceb7024f5d39dd52f16c9de

  • SHA512

    c92b83ba5513694e05cf908a747609dd6fd3c70944d04a9b8a62939f4372561e4feb567d158b0316853c50a0c241a1c8c075875746a1e538912ea91ff84c308e

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

Mutex

chhphkahmfnasuyziqc

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %Temp%

aes.plain
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\IndependenciesInstallation.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Windows\system32\timeout.exe
      timeout /t 5
      2⤵
      • Delays execution with timeout.exe
      PID:2380
    • C:\Windows\system32\timeout.exe
      timeout /t 1
      2⤵
      • Delays execution with timeout.exe
      PID:2340
    • C:\Windows\system32\timeout.exe
      timeout /t 3
      2⤵
      • Delays execution with timeout.exe
      PID:1728
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\msgbox.vbs"
      2⤵
        PID:2856
      • C:\Windows\system32\timeout.exe
        timeout /t 4
        2⤵
        • Delays execution with timeout.exe
        PID:2580
      • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\C11Setup.exe
        C11Setup.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2696 -s 580
          3⤵
            PID:2668
        • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\GuiLoader.exe
          GuiLoader.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2728
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2936
        • C:\Users\Admin\AppData\Local\Temp\C11Bootstrapper\Properties\PageEditor.exe
          PageEditor.exe
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2800

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2696-31-0x0000000000D00000-0x0000000000D44000-memory.dmp

        Filesize

        272KB

      • memory/2696-35-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

        Filesize

        9.9MB

      • memory/2728-30-0x0000000001390000-0x00000000013D4000-memory.dmp

        Filesize

        272KB

      • memory/2728-34-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

        Filesize

        9.9MB

      • memory/2728-37-0x000000001A8F0000-0x000000001A970000-memory.dmp

        Filesize

        512KB

      • memory/2728-38-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

        Filesize

        9.9MB

      • memory/2800-29-0x0000000000200000-0x0000000000218000-memory.dmp

        Filesize

        96KB

      • memory/2800-33-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

        Filesize

        9.9MB

      • memory/2800-36-0x000000001A710000-0x000000001A790000-memory.dmp

        Filesize

        512KB

      • memory/2800-39-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

        Filesize

        9.9MB