Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 07:11

General

  • Target

    7b05be5398ce2cbc424d40b82b8bb4fe.exe

  • Size

    663KB

  • MD5

    7b05be5398ce2cbc424d40b82b8bb4fe

  • SHA1

    6c158dc6c7324e5b76bb9d89916261c778c23f63

  • SHA256

    472819b55a8804b4d8787f5e45cc9b1aeb1026d5819f06e91bbc022d53ccae5c

  • SHA512

    ddb856adf6ddf8d8f696b48a1b5d27584be742bc9f47e4bf07b0dca101be9afa598a087d7bc8e5dc9c0d515d0e7333093ef4c597bd8d3197a2e340caf9da8257

  • SSDEEP

    12288:fU3929BC4rqhpqBHIA01a29EprIHAJp3UadAAHkR:fU89BNuhaoEprIHAJpkoAr

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

5.252.165.55:1986

Mutex

AsyncMutex_5SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    Notes.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe
    "C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5056
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZjHuIvPfp.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5028
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZjHuIvPfp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC033.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1616
    • C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe
      "C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"
      2⤵
        PID:4896
      • C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe
        "C:\Users\Admin\AppData\Local\Temp\7b05be5398ce2cbc424d40b82b8bb4fe.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Notes" /tr '"C:\Users\Admin\AppData\Roaming\Notes.exe"' & exit
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "Notes" /tr '"C:\Users\Admin\AppData\Roaming\Notes.exe"'
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:1684
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD409.tmp.bat""
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3548
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            4⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:3012
          • C:\Users\Admin\AppData\Roaming\Notes.exe
            "C:\Users\Admin\AppData\Roaming\Notes.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3664
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Notes.exe"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2124
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZjHuIvPfp.exe"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4236
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZjHuIvPfp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C1E.tmp"
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3028
            • C:\Users\Admin\AppData\Roaming\Notes.exe
              "C:\Users\Admin\AppData\Roaming\Notes.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7b05be5398ce2cbc424d40b82b8bb4fe.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      3d086a433708053f9bf9523e1d87a4e8

      SHA1

      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

      SHA256

      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

      SHA512

      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      f2c093ff3a1990e50629fa8d564e76a3

      SHA1

      9a6150744edfbce91b68bc2a305372c55a9a7c63

      SHA256

      55f496214a0c2ef65eee9bf8a1abf63a2de1860aff765053ac08e2157d3631f9

      SHA512

      40b1c40d36be2d599ed3bf06ce74cb3bb28af8f168015011e21a589d8076ac4b6c94b196eb81d08b9db7d9fd6f36ea06f0eac9b592a12b87026653c387c3ee4d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      58f8dad3666a7ddd4caa82585d1f29e3

      SHA1

      e0cf1320d6fc09ceb06b3a3f97fc664092ce8843

      SHA256

      d918dd223101722ce8803a64616ee3c6df8a904036a8c9d23ae18ca674e18ecc

      SHA512

      6852a2d2ee96b4566ceab48c34a51bc787533d32d3968be18b6f243b4f4c43956f3aa59b2ded53e5d56e56a9a52f36458e545c43a652c9def12c29b8aeb8538d

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4hqgqbk.fb0.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpC033.tmp

      Filesize

      1KB

      MD5

      af56a198c1fc8d65abf27dc639b50949

      SHA1

      dc7461a4a36e5613689863bef381a4b0d5bb8566

      SHA256

      206e23d322a4e78d77f652238a684cd11cc0f10aa5d0a4277815a5293b631e37

      SHA512

      93f82f61dc13d582fb221e03f2bd8e84667a028a6181a7b9dce427bdf422e4448c19bd483c7b6022961b588d65a38dd7129f09483fdf5ef08c54f62e7c30c118

    • C:\Users\Admin\AppData\Local\Temp\tmpD409.tmp.bat

      Filesize

      149B

      MD5

      d1d0248e5b4bfdb968841e10571a995b

      SHA1

      ed5f289ae52a149025ae50decded7755fd3eeda8

      SHA256

      74919b43cd10690e2a06300d29e5630106258ea0a36c905e9bf0c4e20023e6d3

      SHA512

      6ce3a2d116f8527317f987f888f146d270a82ed4fb29ee648cdb04b24c6b070d895740844d37aa431f7265bbe44d29c28c17fd118f5738bda86c482213b7dc06

    • C:\Users\Admin\AppData\Roaming\Notes.exe

      Filesize

      663KB

      MD5

      7b05be5398ce2cbc424d40b82b8bb4fe

      SHA1

      6c158dc6c7324e5b76bb9d89916261c778c23f63

      SHA256

      472819b55a8804b4d8787f5e45cc9b1aeb1026d5819f06e91bbc022d53ccae5c

      SHA512

      ddb856adf6ddf8d8f696b48a1b5d27584be742bc9f47e4bf07b0dca101be9afa598a087d7bc8e5dc9c0d515d0e7333093ef4c597bd8d3197a2e340caf9da8257

    • memory/1156-33-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1504-6-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/1504-3-0x0000000004B80000-0x0000000004C12000-memory.dmp

      Filesize

      584KB

    • memory/1504-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

      Filesize

      4KB

    • memory/1504-47-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/1504-1-0x0000000000100000-0x00000000001A8000-memory.dmp

      Filesize

      672KB

    • memory/1504-2-0x00000000051F0000-0x0000000005794000-memory.dmp

      Filesize

      5.6MB

    • memory/1504-9-0x0000000005FA0000-0x0000000005FF4000-memory.dmp

      Filesize

      336KB

    • memory/1504-4-0x0000000004D40000-0x0000000004D4A000-memory.dmp

      Filesize

      40KB

    • memory/1504-8-0x0000000005180000-0x000000000518E000-memory.dmp

      Filesize

      56KB

    • memory/1504-7-0x0000000005160000-0x0000000005176000-memory.dmp

      Filesize

      88KB

    • memory/1504-5-0x0000000004EA0000-0x0000000004F3C000-memory.dmp

      Filesize

      624KB

    • memory/2124-121-0x0000000005C90000-0x0000000005CDC000-memory.dmp

      Filesize

      304KB

    • memory/2124-132-0x0000000075CA0000-0x0000000075CEC000-memory.dmp

      Filesize

      304KB

    • memory/2124-144-0x0000000007150000-0x0000000007164000-memory.dmp

      Filesize

      80KB

    • memory/4236-100-0x0000000005AD0000-0x0000000005E24000-memory.dmp

      Filesize

      3.3MB

    • memory/4236-122-0x0000000075CA0000-0x0000000075CEC000-memory.dmp

      Filesize

      304KB

    • memory/4236-142-0x0000000007370000-0x0000000007413000-memory.dmp

      Filesize

      652KB

    • memory/4236-143-0x00000000076C0000-0x00000000076D1000-memory.dmp

      Filesize

      68KB

    • memory/5028-88-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/5028-85-0x0000000007C10000-0x0000000007C18000-memory.dmp

      Filesize

      32KB

    • memory/5028-50-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

      Filesize

      200KB

    • memory/5028-71-0x0000000007790000-0x00000000077AE000-memory.dmp

      Filesize

      120KB

    • memory/5028-44-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/5028-72-0x00000000077C0000-0x0000000007863000-memory.dmp

      Filesize

      652KB

    • memory/5028-73-0x0000000007F40000-0x00000000085BA000-memory.dmp

      Filesize

      6.5MB

    • memory/5028-74-0x00000000078F0000-0x000000000790A000-memory.dmp

      Filesize

      104KB

    • memory/5028-75-0x0000000007960000-0x000000000796A000-memory.dmp

      Filesize

      40KB

    • memory/5028-76-0x0000000007B70000-0x0000000007C06000-memory.dmp

      Filesize

      600KB

    • memory/5028-46-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/5028-78-0x0000000007B20000-0x0000000007B2E000-memory.dmp

      Filesize

      56KB

    • memory/5028-82-0x0000000007B30000-0x0000000007B44000-memory.dmp

      Filesize

      80KB

    • memory/5028-49-0x00000000068E0000-0x000000000692C000-memory.dmp

      Filesize

      304KB

    • memory/5028-32-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/5028-51-0x0000000075C60000-0x0000000075CAC000-memory.dmp

      Filesize

      304KB

    • memory/5028-48-0x00000000065D0000-0x00000000065EE000-memory.dmp

      Filesize

      120KB

    • memory/5056-19-0x0000000004F50000-0x0000000004FB6000-memory.dmp

      Filesize

      408KB

    • memory/5056-84-0x00000000074E0000-0x00000000074FA000-memory.dmp

      Filesize

      104KB

    • memory/5056-92-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/5056-77-0x00000000073A0000-0x00000000073B1000-memory.dmp

      Filesize

      68KB

    • memory/5056-61-0x0000000075C60000-0x0000000075CAC000-memory.dmp

      Filesize

      304KB

    • memory/5056-22-0x0000000005840000-0x0000000005B94000-memory.dmp

      Filesize

      3.3MB

    • memory/5056-20-0x0000000005650000-0x00000000056B6000-memory.dmp

      Filesize

      408KB

    • memory/5056-18-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

      Filesize

      136KB

    • memory/5056-17-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/5056-15-0x0000000005020000-0x0000000005648000-memory.dmp

      Filesize

      6.2MB

    • memory/5056-16-0x00000000753B0000-0x0000000075B60000-memory.dmp

      Filesize

      7.7MB

    • memory/5056-14-0x0000000002550000-0x0000000002586000-memory.dmp

      Filesize

      216KB