Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
101.exe
windows7-x64
81.exe
windows10-1703-x64
81.exe
windows10-2004-x64
81.exe
windows11-21h2-x64
8360setr.exe
windows7-x64
8360setr.exe
windows10-1703-x64
8360setr.exe
windows10-2004-x64
8360setr.exe
windows11-21h2-x64
88989.exe
windows7-x64
108989.exe
windows10-1703-x64
108989.exe
windows10-2004-x64
108989.exe
windows11-21h2-x64
10988.exe
windows7-x64
7988.exe
windows10-1703-x64
3988.exe
windows10-2004-x64
3988.exe
windows11-21h2-x64
3999999.exe
windows7-x64
10999999.exe
windows10-1703-x64
10999999.exe
windows10-2004-x64
10999999.exe
windows11-21h2-x64
10server.exe
windows7-x64
8server.exe
windows10-1703-x64
8server.exe
windows10-2004-x64
8server.exe
windows11-21h2-x64
8·À½Ù³Ö1.0.exe
windows7-x64
8·À½Ù³Ö1.0.exe
windows10-1703-x64
8·À½Ù³Ö1.0.exe
windows10-2004-x64
8·À½Ù³Ö1.0.exe
windows11-21h2-x64
8Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
16/06/2024, 02:37
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral4
Sample
1.exe
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
360setr.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
360setr.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
360setr.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
360setr.exe
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
8989.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
8989.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
8989.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
8989.exe
Resource
win11-20240611-en
Behavioral task
behavioral13
Sample
988.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
988.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
988.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
988.exe
Resource
win11-20240611-en
Behavioral task
behavioral17
Sample
999999.exe
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
999999.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
999999.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
999999.exe
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
server.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
server.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
server.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
server.exe
Resource
win11-20240508-en
Behavioral task
behavioral25
Sample
·À½Ù³Ö1.0.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
·À½Ù³Ö1.0.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
·À½Ù³Ö1.0.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
·À½Ù³Ö1.0.exe
Resource
win11-20240508-en
General
-
Target
999999.exe
-
Size
48KB
-
MD5
2b6bdd0a18e76a5df3a867a49f951125
-
SHA1
f0286405e8c8efb11ad4d30b29f32268ea747c09
-
SHA256
b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f
-
SHA512
ef06c218ad5daf8437fda94c991a4ba86e3bdfd7ef55b64d8fdbe4657bb7acf512c42e7158cce17943a3aa437f96d294dae6eeb908d1f8acacdc4ddb25f27915
-
SSDEEP
768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ahPC:Ub1MsHz3JDwhyWr+N95OTga6Z
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Simullatis\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\240606046.dll" 999999.exe -
Executes dropped EXE 1 IoCs
pid Process 3560 Simullatis.exe -
Loads dropped DLL 3 IoCs
pid Process 2912 999999.exe 1624 svchost.exe 3560 Simullatis.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Simullatis.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Simullatis.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1252 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2912 999999.exe 2912 999999.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2912 999999.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2912 999999.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2912 wrote to memory of 1108 2912 999999.exe 75 PID 2912 wrote to memory of 1108 2912 999999.exe 75 PID 2912 wrote to memory of 1108 2912 999999.exe 75 PID 1108 wrote to memory of 1252 1108 cmd.exe 77 PID 1108 wrote to memory of 1252 1108 cmd.exe 77 PID 1108 wrote to memory of 1252 1108 cmd.exe 77 PID 1624 wrote to memory of 3560 1624 svchost.exe 78 PID 1624 wrote to memory of 3560 1624 svchost.exe 78 PID 1624 wrote to memory of 3560 1624 svchost.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\999999.exe"C:\Users\Admin\AppData\Local\Temp\999999.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\999999.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:1252
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Simullatis"1⤵PID:4416
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Simullatis"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\Simullatis.exeC:\Windows\system32\Simullatis.exe "c:\users\admin\appdata\local\temp\240606046.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5f57886ace1ab4972b0308f69b1a0029c
SHA1519b2a981cb522ed2b0901f9871f9aa9781a6cd5
SHA2562be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852
SHA512c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8
-
Filesize
25KB
MD5da3dd69dae8627334a8479f60eeb082e
SHA135c550902e5c0e6297785c367c2d638dda23404e
SHA25603bc8caca1bab6d14d7eac1dde331df3be91aec47c51c7ddf6646deab028d17e
SHA512b09e6175513d2e75119a67741f6d694722be511b317bd30efed30b4961dc945a97ce6baccc1282a412adaea31d60679183d3a15e7564c04c5dcad712650c5d3c