Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
Tax documents PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Tax documents PDF.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
g2m.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
g2m.dll
Resource
win10v2004-20240226-en
General
-
Target
g2m.dll
-
Size
44.7MB
-
MD5
800ea3a241461649e1bda3aac6854335
-
SHA1
111f1fc6b3d58328e8799b5c93a60b9586580166
-
SHA256
e0f8597fbde807a20dd853711c5cfda779eb18d389277c4a2db63948202723f7
-
SHA512
2aa8dc19e1310f8352af25b5de6da5783da5235847a1a8c8bf15aafc83f9fc6ef207ab25d0075aa858311abb681d82e921eb17a7d0af9f02451d5cf7c5d761af
-
SSDEEP
786432:rUP7GCGO7t0Srkx/tC0SzIdSwh/WxbpNHQD3trzRp2:rUP7GCG6iSrkx1hSzYsHQD3t/Rk
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
5.253.84.218:7878
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\ChromeData.dll,EntryPoint" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1220 set thread context of 3576 1220 regsvr32.exe 101 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3576 csc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 948 wrote to memory of 1220 948 regsvr32.exe 91 PID 948 wrote to memory of 1220 948 regsvr32.exe 91 PID 948 wrote to memory of 1220 948 regsvr32.exe 91 PID 1220 wrote to memory of 3576 1220 regsvr32.exe 101 PID 1220 wrote to memory of 3576 1220 regsvr32.exe 101 PID 1220 wrote to memory of 3576 1220 regsvr32.exe 101 PID 1220 wrote to memory of 3576 1220 regsvr32.exe 101 PID 1220 wrote to memory of 3576 1220 regsvr32.exe 101 PID 1220 wrote to memory of 4468 1220 regsvr32.exe 102 PID 1220 wrote to memory of 4468 1220 regsvr32.exe 102 PID 1220 wrote to memory of 4468 1220 regsvr32.exe 102 PID 4468 wrote to memory of 4108 4468 cmd.exe 104 PID 4468 wrote to memory of 4108 4468 cmd.exe 104 PID 4468 wrote to memory of 4108 4468 cmd.exe 104
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\g2m.dll1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\g2m.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3576
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f & exit3⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f4⤵
- Adds Run key to start application
PID:4108
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:1752