Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
Tax documents PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Tax documents PDF.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
g2m.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
g2m.dll
Resource
win10v2004-20240226-en
General
-
Target
Tax documents PDF.exe
-
Size
31KB
-
MD5
4db45c5fdb9e115b922bdf007523f082
-
SHA1
90297382a170ff3ea7931db2425329d0b2f70f04
-
SHA256
a73709c1b5f1f875ee35f477c4e263a57050c36e2cff31ad1ceca17d9623e7cd
-
SHA512
7f0bcb2ee96c523cce764d1ec7d197d3aadddcf6fae71b63e88c3a26883b2f2fb4a446187adfbb023be779056ebc0ea50a785c72bbe97bb7dca41a810d0ff6c7
-
SSDEEP
384:V4Kj/M8y6ryzqEt7a9Oey+IFdP64VYaEwDtiBgxoxlnLr2STchsCxXBhgBx4eMDg:VHDXr+VWOV+csoHViBBn+hRIqeMDGt
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
5.253.84.218:7878
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\ChromeData.dll,EntryPoint" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1944 set thread context of 1008 1944 Tax documents PDF.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1008 csc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1008 1944 Tax documents PDF.exe 28 PID 1944 wrote to memory of 1008 1944 Tax documents PDF.exe 28 PID 1944 wrote to memory of 1008 1944 Tax documents PDF.exe 28 PID 1944 wrote to memory of 1008 1944 Tax documents PDF.exe 28 PID 1944 wrote to memory of 1008 1944 Tax documents PDF.exe 28 PID 1944 wrote to memory of 1008 1944 Tax documents PDF.exe 28 PID 1944 wrote to memory of 2612 1944 Tax documents PDF.exe 30 PID 1944 wrote to memory of 2612 1944 Tax documents PDF.exe 30 PID 1944 wrote to memory of 2612 1944 Tax documents PDF.exe 30 PID 1944 wrote to memory of 2612 1944 Tax documents PDF.exe 30 PID 2612 wrote to memory of 2704 2612 cmd.exe 32 PID 2612 wrote to memory of 2704 2612 cmd.exe 32 PID 2612 wrote to memory of 2704 2612 cmd.exe 32 PID 2612 wrote to memory of 2704 2612 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tax documents PDF.exe"C:\Users\Admin\AppData\Local\Temp\Tax documents PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f3⤵
- Adds Run key to start application
PID:2704
-
-