Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
29/07/2024, 04:59
Behavioral task
behavioral1
Sample
runtime.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
win10.exe
Resource
win10v2004-20240709-en
General
-
Target
runtime.exe
-
Size
73KB
-
MD5
4fa7b1eec1fc84eb3a13c29e5a37aae7
-
SHA1
dfff9fceeb4d74d7e82f9f0a65d1889fa0f9e326
-
SHA256
5f5aa560b9b2d9f7ea3b9a4e05b9b9b35107dc78bd763000fe05f6b3f998f311
-
SHA512
5e36a5589499a3db56d78de1b66a9ee57a2972bc57bf4b915df9118fd2a584c74ba00c61531d922431b72e87f9c53585c4c1a78a2aba122a22ea5e3603aa06ba
-
SSDEEP
1536:KIUme0cxdlOH4PAI7Bn3h36rAi8EjZUPMwC/eqmmRhdWVH1bfbfPmjmwzUYbVclN:KIUm3cxdlOH4YI7Bn3h36rAi8EVUPMwv
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Default
72.5.43.15:4449
yezcydjwbxouz
-
delay
1
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x00070000000234dd-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation runtime.exe -
Executes dropped EXE 1 IoCs
pid Process 4620 win.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1812 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2796 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 1216 runtime.exe 4620 win.exe 4620 win.exe 4620 win.exe 4620 win.exe 4620 win.exe 4620 win.exe 4620 win.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1216 runtime.exe Token: SeDebugPrivilege 4620 win.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4620 win.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1216 wrote to memory of 4104 1216 runtime.exe 88 PID 1216 wrote to memory of 4104 1216 runtime.exe 88 PID 1216 wrote to memory of 1456 1216 runtime.exe 90 PID 1216 wrote to memory of 1456 1216 runtime.exe 90 PID 4104 wrote to memory of 2796 4104 cmd.exe 92 PID 4104 wrote to memory of 2796 4104 cmd.exe 92 PID 1456 wrote to memory of 1812 1456 cmd.exe 93 PID 1456 wrote to memory of 1812 1456 cmd.exe 93 PID 1456 wrote to memory of 4620 1456 cmd.exe 94 PID 1456 wrote to memory of 4620 1456 cmd.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\runtime.exe"C:\Users\Admin\AppData\Local\Temp\runtime.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2796
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEB3B.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1812
-
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD5cf2d9d67c6eeb041eaa7568b77d9c41d
SHA18aa951c5647dea24bd32984e42cc724304bfa306
SHA256a1d9962827628e7ee0a2d1760e878fd35856c8b452972d2aef01069a814c3241
SHA51272471698a04879f213eea24db5d07034b94c86f040c95a824c50f351c6fb4040ebae18a99751458fdb21ae64a3290abe87cec7eb480b7d5c358ae9622317c5bc
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
73KB
MD54fa7b1eec1fc84eb3a13c29e5a37aae7
SHA1dfff9fceeb4d74d7e82f9f0a65d1889fa0f9e326
SHA2565f5aa560b9b2d9f7ea3b9a4e05b9b9b35107dc78bd763000fe05f6b3f998f311
SHA5125e36a5589499a3db56d78de1b66a9ee57a2972bc57bf4b915df9118fd2a584c74ba00c61531d922431b72e87f9c53585c4c1a78a2aba122a22ea5e3603aa06ba