Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
29/07/2024, 12:59
Behavioral task
behavioral1
Sample
556407eba4cd85a57fdb6dcdb12e2269.exe
Resource
win7-20240704-en
General
-
Target
556407eba4cd85a57fdb6dcdb12e2269.exe
-
Size
45KB
-
MD5
556407eba4cd85a57fdb6dcdb12e2269
-
SHA1
d68a0f0831556c4ef3fb3e003385e897a210b751
-
SHA256
0f07d465b2fb93b367ff2a393574f87b932e4627591091bf8f2f94d3c8e75715
-
SHA512
d7baa345dac09eb418604a3d6ace4af0a54cb2b5a627967bc9ccdbb5ee5021ef6dd1e042fcc4165aeb5a38f8583af56f99e5472fa1442ee0335cf62e9664c6c0
-
SSDEEP
768:uuokxmFTkUE1YAgWUOl1nyamo2qR+1uGJAIGYPPI3njbMgX3iWHCHiGTCE2BDZax:uuokxmFTkUMYi1t2HsNx3jbDXSWHnGm0
Malware Config
Extracted
asyncrat
0.5.8
Default
193.23.160.13:7707
zTAsGorHPqSl
-
delay
3
-
install
true
-
install_file
Server-Host.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b00000002339d-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 556407eba4cd85a57fdb6dcdb12e2269.exe -
Executes dropped EXE 1 IoCs
pid Process 4764 Server-Host.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 556407eba4cd85a57fdb6dcdb12e2269.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server-Host.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4720 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4440 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 1708 556407eba4cd85a57fdb6dcdb12e2269.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1708 556407eba4cd85a57fdb6dcdb12e2269.exe Token: SeDebugPrivilege 4764 Server-Host.exe Token: SeDebugPrivilege 4764 Server-Host.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1708 wrote to memory of 3968 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 91 PID 1708 wrote to memory of 3968 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 91 PID 1708 wrote to memory of 3968 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 91 PID 1708 wrote to memory of 1716 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 93 PID 1708 wrote to memory of 1716 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 93 PID 1708 wrote to memory of 1716 1708 556407eba4cd85a57fdb6dcdb12e2269.exe 93 PID 1716 wrote to memory of 4720 1716 cmd.exe 95 PID 1716 wrote to memory of 4720 1716 cmd.exe 95 PID 1716 wrote to memory of 4720 1716 cmd.exe 95 PID 3968 wrote to memory of 4440 3968 cmd.exe 96 PID 3968 wrote to memory of 4440 3968 cmd.exe 96 PID 3968 wrote to memory of 4440 3968 cmd.exe 96 PID 1716 wrote to memory of 4764 1716 cmd.exe 98 PID 1716 wrote to memory of 4764 1716 cmd.exe 98 PID 1716 wrote to memory of 4764 1716 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\556407eba4cd85a57fdb6dcdb12e2269.exe"C:\Users\Admin\AppData\Local\Temp\556407eba4cd85a57fdb6dcdb12e2269.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Server-Host" /tr '"C:\Users\Admin\AppData\Roaming\Server-Host.exe"' & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Server-Host" /tr '"C:\Users\Admin\AppData\Roaming\Server-Host.exe"'3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA5D5.tmp.bat""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4720
-
-
C:\Users\Admin\AppData\Roaming\Server-Host.exe"C:\Users\Admin\AppData\Roaming\Server-Host.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155B
MD5488d2a2fbaf2ab52a8f2dd591492d5cd
SHA195ca11eb2729f6dc2d1dc21d715eb7e961b2a5b5
SHA256d34a714488bbc1740d8bf2e61ccf9d912f7780c235e5fec41440512e5835b817
SHA512bb0e7441d3cc558c31999192556c4f7fb4a1ae5c7d89bf8c54e6e030c02d2499daec30eb90313cc1b69c5fca154aa9f0be1793e15f8d880748023d8db3b19483
-
Filesize
45KB
MD5556407eba4cd85a57fdb6dcdb12e2269
SHA1d68a0f0831556c4ef3fb3e003385e897a210b751
SHA2560f07d465b2fb93b367ff2a393574f87b932e4627591091bf8f2f94d3c8e75715
SHA512d7baa345dac09eb418604a3d6ace4af0a54cb2b5a627967bc9ccdbb5ee5021ef6dd1e042fcc4165aeb5a38f8583af56f99e5472fa1442ee0335cf62e9664c6c0