Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 06:44
Behavioral task
behavioral1
Sample
rh111.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
rh111.exe
Resource
win10v2004-20240802-en
General
-
Target
rh111.exe
-
Size
798KB
-
MD5
90aadf2247149996ae443e2c82af3730
-
SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502
-
SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
-
SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
SSDEEP
24576:Uj0JJ4p/A4npt3XojeQG5EtzRtO7GvmDguXd:UjoJ4u4zojegylDN
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rh111.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rh111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rh111.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rh111.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 632 wrote to memory of 4500 632 rh111.exe 85 PID 632 wrote to memory of 4500 632 rh111.exe 85 PID 632 wrote to memory of 4500 632 rh111.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\rh111.exe"C:\Users\Admin\AppData\Local\Temp\rh111.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:384
-
C:\Users\Admin\AppData\Local\Temp\rh111.exe"C:\Users\Admin\AppData\Local\Temp\rh111.exe" -service -lunch1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\rh111.exe"C:\Users\Admin\AppData\Local\Temp\rh111.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
334B
MD527dadd59bd2f673aed38ea464bdaf683
SHA1913e9be810c4bef8359757de7157a574522cea8e
SHA256d5222c432d7870cec22e7df697c9379138866580d2e5e98fabfad04a5fc66f97
SHA51284271ff37b4e60f2f3b6c8b8160434b2735ff8fcae1d1b46215d67735b92dda6333fe740e4c588fe2041ceb1bf54d7cc5b6b22169729e630f80718e0578f5c35