Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 05:16
Static task
static1
Behavioral task
behavioral1
Sample
2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe
Resource
win7-20240729-en
General
-
Target
2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe
-
Size
589KB
-
MD5
d53fc47751fa8ad0b613c489aa779bda
-
SHA1
ec14fabb10b9aa9f05344c03802294e114bb2af1
-
SHA256
2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea
-
SHA512
b6441aeff786d23401267f23960410614a2686e3d10b6f58c5e9042d7c2f48a4975383f2ec05cfc801faa39a3bbb6bb58161b5ec248252c89ab9bf6ef382e326
-
SSDEEP
12288:ToQyRAMIgF72A0ybuxRN750J4iWoM7+EgLHpP3V5Ua:uHIgF7Wybexo4iWoM7oHpP3TR
Malware Config
Extracted
asyncrat
0.5.8
REED
bmh-global.myfirewall.org:15153
2bL4M7bieVyn
-
delay
10
-
install
true
-
install_file
windows manger.exe
-
install_folder
%Temp%
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2376 windows manger.exe 2720 windows manger.exe -
Loads dropped DLL 3 IoCs
pid Process 1052 cmd.exe 1052 cmd.exe 2376 windows manger.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1956 set thread context of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 2376 set thread context of 2720 2376 windows manger.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windows manger.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windows manger.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 836 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 896 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe Token: SeDebugPrivilege 2720 windows manger.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 1956 wrote to memory of 2728 1956 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 29 PID 2728 wrote to memory of 2696 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 31 PID 2728 wrote to memory of 2696 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 31 PID 2728 wrote to memory of 2696 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 31 PID 2728 wrote to memory of 2696 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 31 PID 2728 wrote to memory of 1052 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 33 PID 2728 wrote to memory of 1052 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 33 PID 2728 wrote to memory of 1052 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 33 PID 2728 wrote to memory of 1052 2728 2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe 33 PID 2696 wrote to memory of 896 2696 cmd.exe 35 PID 2696 wrote to memory of 896 2696 cmd.exe 35 PID 2696 wrote to memory of 896 2696 cmd.exe 35 PID 2696 wrote to memory of 896 2696 cmd.exe 35 PID 1052 wrote to memory of 836 1052 cmd.exe 36 PID 1052 wrote to memory of 836 1052 cmd.exe 36 PID 1052 wrote to memory of 836 1052 cmd.exe 36 PID 1052 wrote to memory of 836 1052 cmd.exe 36 PID 1052 wrote to memory of 2376 1052 cmd.exe 37 PID 1052 wrote to memory of 2376 1052 cmd.exe 37 PID 1052 wrote to memory of 2376 1052 cmd.exe 37 PID 1052 wrote to memory of 2376 1052 cmd.exe 37 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38 PID 2376 wrote to memory of 2720 2376 windows manger.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe"C:\Users\Admin\AppData\Local\Temp\2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe"C:\Users\Admin\AppData\Local\Temp\2328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows manger" /tr '"C:\Users\Admin\AppData\Local\Temp\windows manger.exe"' & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows manger" /tr '"C:\Users\Admin\AppData\Local\Temp\windows manger.exe"'4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8BCB.tmp.bat""3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\windows manger.exe"C:\Users\Admin\AppData\Local\Temp\windows manger.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\windows manger.exe"C:\Users\Admin\AppData\Local\Temp\windows manger.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
161B
MD5e83116086b17d855d63a6a5a59f3a98c
SHA147de172df97750dca519db97eb526517d19c2dd8
SHA2563c04307d3d485b3a261934939e53d995b2766770ebc563c96e4490a11ff0b593
SHA5121e670aceb9847b5c70b74ce75b43b2c9b5e26a409d5178a38dfefcdacbb9f706aa1a00f83800e2ca9339f5e958e47c4ec8f55b15e8a1e1f7f29614a39f331f57
-
Filesize
589KB
MD5d53fc47751fa8ad0b613c489aa779bda
SHA1ec14fabb10b9aa9f05344c03802294e114bb2af1
SHA2562328201990de5c77c0353c61e628c68a01aaef1d4566ef9816a1f0333562c5ea
SHA512b6441aeff786d23401267f23960410614a2686e3d10b6f58c5e9042d7c2f48a4975383f2ec05cfc801faa39a3bbb6bb58161b5ec248252c89ab9bf6ef382e326