Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 18:30
Behavioral task
behavioral1
Sample
59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe
Resource
win7-20240419-en
General
-
Target
59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe
-
Size
5.5MB
-
MD5
e04ff28b883fb40ac8871f5699a35111
-
SHA1
1a9a2152d6c82992bbf39c8c2f096d8ea0175923
-
SHA256
59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4
-
SHA512
793b0f537b3b16414c98a7c237415734164fff3b70d771238033e07de2c7bac94748a9fb30b2ee371b0eacd71d0c9c7fbf68ffdc3f72d1ce693272ddd7dc0f35
-
SSDEEP
98304:Lws2ANnKXOaeOgmhYJnlEa9tX3ZO2rkNEZq1jKJBAUZLKvu:NKXbeO7GJnlECvhJVYu
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/files/0x00070000000233f7-42.dat family_blackmoon behavioral2/memory/4184-46-0x0000000010000000-0x0000000010036000-memory.dmp family_blackmoon -
resource yara_rule behavioral2/memory/776-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/776-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/776-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4984-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4984-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4872-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4872-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4872-45-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral2/files/0x00070000000233f1-5.dat family_gh0strat behavioral2/memory/776-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/776-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/776-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4984-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4984-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4872-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4872-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4872-45-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240597890.txt" R.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Executes dropped EXE 6 IoCs
pid Process 3200 R.exe 776 N.exe 4984 TXPlatfor.exe 4872 TXPlatfor.exe 4184 HD_59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 1312 Remote Data.exe -
Loads dropped DLL 3 IoCs
pid Process 3200 R.exe 3164 svchost.exe 1312 Remote Data.exe -
resource yara_rule behavioral2/memory/776-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/776-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/776-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/776-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4984-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4984-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4984-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4872-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4872-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4872-45-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\240597890.txt R.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5116 4184 WerFault.exe 87 -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3220 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4872 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 776 N.exe Token: SeLoadDriverPrivilege 4872 TXPlatfor.exe Token: 33 4872 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4872 TXPlatfor.exe Token: 33 4872 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4872 TXPlatfor.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 4184 HD_59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 4184 HD_59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3368 wrote to memory of 3200 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 80 PID 3368 wrote to memory of 3200 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 80 PID 3368 wrote to memory of 3200 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 80 PID 3368 wrote to memory of 776 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 83 PID 3368 wrote to memory of 776 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 83 PID 3368 wrote to memory of 776 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 83 PID 4984 wrote to memory of 4872 4984 TXPlatfor.exe 86 PID 4984 wrote to memory of 4872 4984 TXPlatfor.exe 86 PID 4984 wrote to memory of 4872 4984 TXPlatfor.exe 86 PID 776 wrote to memory of 3556 776 N.exe 85 PID 776 wrote to memory of 3556 776 N.exe 85 PID 776 wrote to memory of 3556 776 N.exe 85 PID 3368 wrote to memory of 4184 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 87 PID 3368 wrote to memory of 4184 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 87 PID 3368 wrote to memory of 4184 3368 59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe 87 PID 3556 wrote to memory of 3220 3556 cmd.exe 89 PID 3556 wrote to memory of 3220 3556 cmd.exe 89 PID 3556 wrote to memory of 3220 3556 cmd.exe 89 PID 3164 wrote to memory of 1312 3164 svchost.exe 97 PID 3164 wrote to memory of 1312 3164 svchost.exe 97 PID 3164 wrote to memory of 1312 3164 svchost.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe"C:\Users\Admin\AppData\Local\Temp\59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3200
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3220
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exeC:\Users\Admin\AppData\Local\Temp\HD_59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 7003⤵
- Program crash
PID:5116
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:2912
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240597890.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4184 -ip 41841⤵PID:3252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_59c4c99b8a0ef493887692eafe53e0eaa657da688fce3e42d510725311d208f4.exe
Filesize3.0MB
MD5e6cecf855969a82fb217c1caba60ebb7
SHA161c633480d30cb5350ca295ce4f0d0a41443e5c6
SHA256d99b0a9364710ea3bbd078055e27d4b8dd3ea2542e08d5c259968e5576124216
SHA512ed44fd4e8cc408c69b809ae9a53c4e80ee9bff881074420fbd317c92604cca848528a5297d3c56190064099a78c8994aa448dd45c7fabafc911fa53480564b2f
-
Filesize
2.5MB
MD5af3af221604e4e693b28a4843754c1b4
SHA1bcbb47db49668df45cd0e5f75f38ccfc100f23a6
SHA256318984c154686c1a65ea17aeb60140039969c4c62583a0dca2791ff249f81c6a
SHA512b066c4cab37b12708176a7a48ba302923939827bbab4e04416941ad5d61c6745b5149cdfd653b95e005a80fb92e19328171929228a3e4790cb3dcda1da45b0a1
-
Filesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
Filesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
Filesize
899KB
MD5012238bc58b64556cc9fd289f7faaf44
SHA1837c5565c4a9fdde9b361ea842b4193ede5a84bf
SHA256b885c26d19b0dea46ace5a7b18b0327c007499cef2aff5e9c1c2cabd428b23c4
SHA512fd07e3409823d839b6287acdfd0db11d6bb12ae699c70120154a2376cb3cc98408d8204cf2f865bc2afa3578533aafb87dbe441dbeccb4f141590c61a49f73b0
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641