Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
7b05be5398ce2cbc424d40b82b8bb4fe.exe
Resource
win7-20240729-en
General
-
Target
7b05be5398ce2cbc424d40b82b8bb4fe.exe
-
Size
663KB
-
MD5
7b05be5398ce2cbc424d40b82b8bb4fe
-
SHA1
6c158dc6c7324e5b76bb9d89916261c778c23f63
-
SHA256
472819b55a8804b4d8787f5e45cc9b1aeb1026d5819f06e91bbc022d53ccae5c
-
SHA512
ddb856adf6ddf8d8f696b48a1b5d27584be742bc9f47e4bf07b0dca101be9afa598a087d7bc8e5dc9c0d515d0e7333093ef4c597bd8d3197a2e340caf9da8257
-
SSDEEP
12288:fU3929BC4rqhpqBHIA01a29EprIHAJp3UadAAHkR:fU89BNuhaoEprIHAJpkoAr
Malware Config
Extracted
asyncrat
0.5.7B
Default
5.252.165.55:1986
AsyncMutex_5SI8OkPnk
-
delay
3
-
install
true
-
install_file
Notes.exe
-
install_folder
%AppData%
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4236 powershell.exe 5056 powershell.exe 5028 powershell.exe 2124 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 7b05be5398ce2cbc424d40b82b8bb4fe.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 7b05be5398ce2cbc424d40b82b8bb4fe.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Notes.exe -
Executes dropped EXE 2 IoCs
pid Process 3664 Notes.exe 4428 Notes.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1504 set thread context of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 3664 set thread context of 4428 3664 Notes.exe 109 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b05be5398ce2cbc424d40b82b8bb4fe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b05be5398ce2cbc424d40b82b8bb4fe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3012 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1616 schtasks.exe 1684 schtasks.exe 3028 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 5028 powershell.exe 5056 powershell.exe 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 5028 powershell.exe 5056 powershell.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 2124 powershell.exe 4236 powershell.exe 2124 powershell.exe 4236 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 5056 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeDebugPrivilege 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe Token: SeDebugPrivilege 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 4236 powershell.exe Token: SeDebugPrivilege 4428 Notes.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1504 wrote to memory of 5056 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 86 PID 1504 wrote to memory of 5056 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 86 PID 1504 wrote to memory of 5056 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 86 PID 1504 wrote to memory of 5028 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 88 PID 1504 wrote to memory of 5028 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 88 PID 1504 wrote to memory of 5028 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 88 PID 1504 wrote to memory of 1616 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 90 PID 1504 wrote to memory of 1616 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 90 PID 1504 wrote to memory of 1616 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 90 PID 1504 wrote to memory of 4896 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 92 PID 1504 wrote to memory of 4896 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 92 PID 1504 wrote to memory of 4896 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 92 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1504 wrote to memory of 1156 1504 7b05be5398ce2cbc424d40b82b8bb4fe.exe 93 PID 1156 wrote to memory of 3224 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 94 PID 1156 wrote to memory of 3224 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 94 PID 1156 wrote to memory of 3224 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 94 PID 1156 wrote to memory of 3548 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 95 PID 1156 wrote to memory of 3548 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 95 PID 1156 wrote to memory of 3548 1156 7b05be5398ce2cbc424d40b82b8bb4fe.exe 95 PID 3224 wrote to memory of 1684 3224 cmd.exe 98 PID 3224 wrote to memory of 1684 3224 cmd.exe 98 PID 3224 wrote to memory of 1684 3224 cmd.exe 98 PID 3548 wrote to memory of 3012 3548 cmd.exe 99 PID 3548 wrote to memory of 3012 3548 cmd.exe 99 PID 3548 wrote to memory of 3012 3548 cmd.exe 99 PID 3548 wrote to memory of 3664 3548 cmd.exe 100 PID 3548 wrote to memory of 3664 3548 cmd.exe 100 PID 3548 wrote to memory of 3664 3548 cmd.exe 100 PID 3664 wrote to memory of 2124 3664 Notes.exe 103 PID 3664 wrote to memory of 2124 3664 Notes.exe 103 PID 3664 wrote to memory of 2124 3664 Notes.exe 103 PID 3664 wrote to memory of 4236 3664 Notes.exe 105 PID 3664 wrote to memory of 4236 3664 Notes.exe 105 PID 3664 wrote to memory of 4236 3664 Notes.exe 105 PID 3664 wrote to memory of 3028 3664 Notes.exe 107 PID 3664 wrote to memory of 3028 3664 Notes.exe 107 PID 3664 wrote to memory of 3028 3664 Notes.exe 107 PID 3664 wrote to memory of 4428 3664 Notes.exe 109 PID 3664 wrote to memory of 4428 3664 Notes.exe 109 PID 3664 wrote to memory of 4428 3664 Notes.exe 109 PID 3664 wrote to memory of 4428 3664 Notes.exe 109 PID 3664 wrote to memory of 4428 3664 Notes.exe 109 PID 3664 wrote to memory of 4428 3664 Notes.exe 109 PID 3664 wrote to memory of 4428 3664 Notes.exe 109 PID 3664 wrote to memory of 4428 3664 Notes.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZjHuIvPfp.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZjHuIvPfp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC033.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"2⤵PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Notes" /tr '"C:\Users\Admin\AppData\Roaming\Notes.exe"' & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Notes" /tr '"C:\Users\Admin\AppData\Roaming\Notes.exe"'4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD409.tmp.bat""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3012
-
-
C:\Users\Admin\AppData\Roaming\Notes.exe"C:\Users\Admin\AppData\Roaming\Notes.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Notes.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZjHuIvPfp.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZjHuIvPfp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C1E.tmp"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3028
-
-
C:\Users\Admin\AppData\Roaming\Notes.exe"C:\Users\Admin\AppData\Roaming\Notes.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7b05be5398ce2cbc424d40b82b8bb4fe.exe.log
Filesize1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5f2c093ff3a1990e50629fa8d564e76a3
SHA19a6150744edfbce91b68bc2a305372c55a9a7c63
SHA25655f496214a0c2ef65eee9bf8a1abf63a2de1860aff765053ac08e2157d3631f9
SHA51240b1c40d36be2d599ed3bf06ce74cb3bb28af8f168015011e21a589d8076ac4b6c94b196eb81d08b9db7d9fd6f36ea06f0eac9b592a12b87026653c387c3ee4d
-
Filesize
18KB
MD558f8dad3666a7ddd4caa82585d1f29e3
SHA1e0cf1320d6fc09ceb06b3a3f97fc664092ce8843
SHA256d918dd223101722ce8803a64616ee3c6df8a904036a8c9d23ae18ca674e18ecc
SHA5126852a2d2ee96b4566ceab48c34a51bc787533d32d3968be18b6f243b4f4c43956f3aa59b2ded53e5d56e56a9a52f36458e545c43a652c9def12c29b8aeb8538d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5af56a198c1fc8d65abf27dc639b50949
SHA1dc7461a4a36e5613689863bef381a4b0d5bb8566
SHA256206e23d322a4e78d77f652238a684cd11cc0f10aa5d0a4277815a5293b631e37
SHA51293f82f61dc13d582fb221e03f2bd8e84667a028a6181a7b9dce427bdf422e4448c19bd483c7b6022961b588d65a38dd7129f09483fdf5ef08c54f62e7c30c118
-
Filesize
149B
MD5d1d0248e5b4bfdb968841e10571a995b
SHA1ed5f289ae52a149025ae50decded7755fd3eeda8
SHA25674919b43cd10690e2a06300d29e5630106258ea0a36c905e9bf0c4e20023e6d3
SHA5126ce3a2d116f8527317f987f888f146d270a82ed4fb29ee648cdb04b24c6b070d895740844d37aa431f7265bbe44d29c28c17fd118f5738bda86c482213b7dc06
-
Filesize
663KB
MD57b05be5398ce2cbc424d40b82b8bb4fe
SHA16c158dc6c7324e5b76bb9d89916261c778c23f63
SHA256472819b55a8804b4d8787f5e45cc9b1aeb1026d5819f06e91bbc022d53ccae5c
SHA512ddb856adf6ddf8d8f696b48a1b5d27584be742bc9f47e4bf07b0dca101be9afa598a087d7bc8e5dc9c0d515d0e7333093ef4c597bd8d3197a2e340caf9da8257