Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe
Resource
win7-20231129-en
General
-
Target
3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe
-
Size
1.2MB
-
MD5
281e38a8b287fb71daf080254c8244da
-
SHA1
0f8a03acd4417bf4542c4fc0348b7e872d95be1c
-
SHA256
3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194
-
SHA512
902dabae67a15b531da3c8399d1b635a5083224aea44e8c241a04ae40cc299147697759036f5489a665316adfcc2ab5d9a62118c58a5fc24501da8f1d570bdae
-
SSDEEP
24576:f09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+k2EE7:f09XJt4HIN2H2tFvduyS+2T
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4836-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4836-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4836-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3336-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3336-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3336-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3336-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3092-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3092-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3092-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3092-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
resource yara_rule behavioral2/memory/4836-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4836-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4836-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3336-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3336-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3336-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3336-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3092-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3092-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3092-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3092-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 4836 RVN.exe 3336 TXPlatforn.exe 3092 TXPlatforn.exe 232 HD_3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe -
resource yara_rule behavioral2/memory/4836-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4836-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4836-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4836-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3336-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3336-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3336-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3336-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3336-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3092-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3092-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3092-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3092-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3444 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3092 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4836 RVN.exe Token: SeLoadDriverPrivilege 3092 TXPlatforn.exe Token: 33 3092 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3092 TXPlatforn.exe Token: 33 3092 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3092 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4836 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 83 PID 2136 wrote to memory of 4836 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 83 PID 2136 wrote to memory of 4836 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 83 PID 4836 wrote to memory of 2824 4836 RVN.exe 85 PID 4836 wrote to memory of 2824 4836 RVN.exe 85 PID 4836 wrote to memory of 2824 4836 RVN.exe 85 PID 2136 wrote to memory of 232 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 86 PID 2136 wrote to memory of 232 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 86 PID 2136 wrote to memory of 232 2136 3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe 86 PID 3336 wrote to memory of 3092 3336 TXPlatforn.exe 87 PID 3336 wrote to memory of 3092 3336 TXPlatforn.exe 87 PID 3336 wrote to memory of 3092 3336 TXPlatforn.exe 87 PID 2824 wrote to memory of 3444 2824 cmd.exe 89 PID 2824 wrote to memory of 3444 2824 cmd.exe 89 PID 2824 wrote to memory of 3444 2824 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe"C:\Users\Admin\AppData\Local\Temp\3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3444
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exeC:\Users\Admin\AppData\Local\Temp\HD_3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe2⤵
- Executes dropped EXE
PID:232
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_3458df190f0d5d66dc1bba3ee929582fb9f23ac4d81a891eaf5a8edbc1685194.exe
Filesize60KB
MD56706ad61ca22ca189aa7baaf58ae1c26
SHA147c19ac84a36b905f432333d140b989b15e8f0f8
SHA25616cad587efa53f2ee5e012f98633fe8fe44123ae2f27e209d346fc25657042b6
SHA51259fc9cddc0bf4d8d3bbd78bf41d772717f8fb881fc6ade0e2ab340ffc85778afa1a567d75d6a00cfdcd71850b7bf90aefa6395b3b2f6e3ea270b06ed88a90b6d
-
Filesize
1.1MB
MD529405c686a6c5978f3dd8d463e83b626
SHA1fcbf50543236e769aa5462787855a744cd1f104e
SHA2564d0efebcf7877fd97c7701503bd849cad839880a0c27c91492a1079b046dead8
SHA51232de613d4e8fdebabbe09c1f0becad2b3331ca390e6d826721868150c81067ad239c3eed5099ec556d2cf852b60f740c2aa2bb0b9d78f375742dd9aa0ea18ba7
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4