Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 05:23

General

  • Target

    xt.png.ps1

  • Size

    712KB

  • MD5

    8bc95d2d1480070e0cccb017799b7b46

  • SHA1

    868023685bbcd9308b2c0df2aa8bd9ff87054c89

  • SHA256

    1cf135e1f7c5574ed17b6dd7a55406d9f7645cedc44dc400cb90782b1381b321

  • SHA512

    95b105024fe1477dd6e063cbae74ddc312b3a11637d633dd3dd546ec1711b38b49610819388fad3cae4f9ece17a249040d2f955c1ab378e24dbad2bca576a412

  • SSDEEP

    12288:9+x48PQ0D1VF5sh0cxArBhOmg1xHxR3C3rfLG48K:9848PQ0D1b53cxAYK

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

CA

C2

shady-mo.duckdns.org:9090

Mutex

Async_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xt.png.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\OSRSEBJUUOBALHKLTGXZHU.ps1'"
      2⤵
      • Suspicious use of SetThreadContext
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\OSRSEBJUUOBALHKLTGXZHU.ps1

    Filesize

    710KB

    MD5

    3739e5fbe64bf7f544d6bd9caecec20e

    SHA1

    2007e966e3b3b41de5693035a526e1610ab08e73

    SHA256

    8bd1d3957449dba51f31bc1847a58b9f91a72d8899de053b0cd9f796262fc161

    SHA512

    300df7b9ede0ea99a769795fd6243ec00843ab82231daf11ef3c39a666643de6387327e684b5a78891c0ebf5ee105f5724117734a475093ac85b41f1236cbf42

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    0d53533b226ada04703fc90b556978a4

    SHA1

    4bf5e331fce099468eb2f4f34cbedf9411ddb8ae

    SHA256

    1589ebd677356cd2f45d1c79acfe8b8c2e03fa64931aff06e0fd9298cddd58e3

    SHA512

    1215eb84f69328a4bd085dddb4451d027d2569f4d7990b2e492682e17c5aa327015016a27cd384aa4968dfbaea731446b74b0562d73a41ce280e5caab32e3b55

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5bkd3e21.ht1.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/988-66-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/988-79-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

  • memory/988-78-0x0000000005440000-0x00000000054A6000-memory.dmp

    Filesize

    408KB

  • memory/988-77-0x0000000005E40000-0x0000000005EDC000-memory.dmp

    Filesize

    624KB

  • memory/988-76-0x00000000051D0000-0x00000000051DA000-memory.dmp

    Filesize

    40KB

  • memory/988-75-0x0000000005240000-0x00000000052D2000-memory.dmp

    Filesize

    584KB

  • memory/988-74-0x0000000005650000-0x0000000005BF4000-memory.dmp

    Filesize

    5.6MB

  • memory/988-70-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

  • memory/1988-53-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-40-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-62-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-60-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-38-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-65-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1988-58-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-56-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-54-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-24-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1988-50-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-48-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-46-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-44-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-42-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-64-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-36-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-34-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-32-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-30-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-68-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1988-69-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1988-29-0x000001B5EDBE0000-0x000001B5EDC01000-memory.dmp

    Filesize

    132KB

  • memory/1988-28-0x000001B5EDBE0000-0x000001B5EDC08000-memory.dmp

    Filesize

    160KB

  • memory/1988-25-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/1988-27-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/3652-73-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/3652-0-0x00007FFA42513000-0x00007FFA42515000-memory.dmp

    Filesize

    8KB

  • memory/3652-12-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/3652-11-0x00007FFA42510000-0x00007FFA42FD1000-memory.dmp

    Filesize

    10.8MB

  • memory/3652-1-0x0000015CBD8C0000-0x0000015CBD8E2000-memory.dmp

    Filesize

    136KB