Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 16:59
Static task
static1
Behavioral task
behavioral1
Sample
792c34fea9fdbebd00ccb3e2c82bd3a5.exe
Resource
win7-20240221-en
General
-
Target
792c34fea9fdbebd00ccb3e2c82bd3a5.exe
-
Size
221KB
-
MD5
792c34fea9fdbebd00ccb3e2c82bd3a5
-
SHA1
d50a4769a2fca48504e9535a598f1e812d003c2f
-
SHA256
dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
-
SHA512
f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606
-
SSDEEP
3072:chp584YL4TWFxVvaZAUOQDMwutBq17PTPlw92Vr5/6PSr2k5fsPI:chMmSFxhaZQsmBq1bTPlwq/Vr2k5fAI
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2416 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2796 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2880 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Loads dropped DLL 4 IoCs
pid Process 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1912 set thread context of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 set thread context of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 set thread context of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 2500 set thread context of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 set thread context of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 set thread context of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1204 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe Token: SeDebugPrivilege 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2508 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 28 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2472 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 29 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 1912 wrote to memory of 2600 1912 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 30 PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 2508 wrote to memory of 2500 2508 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 31 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2416 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 32 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2796 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 33 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2500 wrote to memory of 2880 2500 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 34 PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37 PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37 PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37 PID 2472 wrote to memory of 1204 2472 792c34fea9fdbebd00ccb3e2c82bd3a5.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2416
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2796
-
-
C:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Roaming\XenoManager\792c34fea9fdbebd00ccb3e2c82bd3a5.exe4⤵
- Executes dropped EXE
PID:2880
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8A1.tmp" /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:1204
-
-
-
C:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exeC:\Users\Admin\AppData\Local\Temp\792c34fea9fdbebd00ccb3e2c82bd3a5.exe2⤵PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54e5246e7abef1fefc0f54218c98badf2
SHA16fc50eec3f46acb1f2129d27e8b006463cad2e44
SHA2562234cdda018017ab71809b5acc4c6a75b1a086552566ec742ae46461a42dace3
SHA51279fc972aee63493401fd0419e642684a6b82cf931b42c93e77c231f7b6cd91e00c457b7f52d5cce40bfd4389fa16b8ec9a87555e449a84330d8fa6a6e07b23cb
-
Filesize
221KB
MD5792c34fea9fdbebd00ccb3e2c82bd3a5
SHA1d50a4769a2fca48504e9535a598f1e812d003c2f
SHA256dc787902ffa15a1b58362cbe8c53af008bf2902426d091bf8e662070a20e8a5a
SHA512f68beb38b7c68432211531d7a6f95626f388089098c878aee956def1e6de96744fa6459064ebd04df01316092cc018ad8321691cdc57265da889f030bf77e606