Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 18:30
Behavioral task
behavioral1
Sample
17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe
Resource
win7-20240704-en
General
-
Target
17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe
-
Size
74KB
-
MD5
31548bc072b604c0617e5ebcf7fc60b4
-
SHA1
035e68c49525e477ca5e61f77e1f8fdd4955b722
-
SHA256
17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e
-
SHA512
9848a6406fa2b6ff3046dd147eb94583fb637a2598dc332905b2a98e171814d3d76554bcf54a909503577fab85ccccf29ae475f614edd3f30e0a62afe8696cb1
-
SSDEEP
1536:mUJQcxAz6/CTGPMVfe9VdQuDI6H1bf/gqcnSQzcaLVclN:mUWcxAW/4GPMVfe9VdQsH1bfQnSQLBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
WindowsRuntimeBrokerService
-
delay
1
-
install
true
-
install_file
Microsoft\Windows\Themes\RuntimeBroker.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/xcd2XZ5Q
Signatures
-
resource yara_rule behavioral1/memory/1932-1-0x0000000000A60000-0x0000000000A78000-memory.dmp VenomRAT behavioral1/files/0x002e000000018f6e-16.dat VenomRAT behavioral1/memory/2876-18-0x0000000001190000-0x00000000011A8000-memory.dmp VenomRAT -
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x002e000000018f6e-16.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2876 RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 5 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2764 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3008 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 2876 RuntimeBroker.exe 2876 RuntimeBroker.exe 2876 RuntimeBroker.exe 2876 RuntimeBroker.exe 2876 RuntimeBroker.exe 2876 RuntimeBroker.exe 2876 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe Token: SeDebugPrivilege 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe Token: SeDebugPrivilege 2876 RuntimeBroker.exe Token: SeDebugPrivilege 2876 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2876 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1932 wrote to memory of 1344 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 30 PID 1932 wrote to memory of 1344 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 30 PID 1932 wrote to memory of 1344 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 30 PID 1932 wrote to memory of 2784 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 32 PID 1932 wrote to memory of 2784 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 32 PID 1932 wrote to memory of 2784 1932 17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe 32 PID 2784 wrote to memory of 2764 2784 cmd.exe 34 PID 2784 wrote to memory of 2764 2784 cmd.exe 34 PID 2784 wrote to memory of 2764 2784 cmd.exe 34 PID 1344 wrote to memory of 3008 1344 cmd.exe 35 PID 1344 wrote to memory of 3008 1344 cmd.exe 35 PID 1344 wrote to memory of 3008 1344 cmd.exe 35 PID 2784 wrote to memory of 2876 2784 cmd.exe 36 PID 2784 wrote to memory of 2876 2784 cmd.exe 36 PID 2784 wrote to memory of 2876 2784 cmd.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe"C:\Users\Admin\AppData\Local\Temp\17dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\RuntimeBroker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\RuntimeBroker.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:3008
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA91B.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2764
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2876
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182B
MD50912d6cf56fbfe225572d40d00fdf691
SHA142d0b106cc7497ce476e9e7e50829549e0431ae6
SHA25621048e7d5ec78f1c5c55af09e2ffb310c4567e5ed7d59719dd35bad5d029a82f
SHA51219e3016affe7cc77dce65b7c9ceb0c2cf42d116f171930aeff787f5081d17b6b87e78835d324f674a527f68b22d4195f397c81d7f57aa4695b04d597ecccae3d
-
Filesize
74KB
MD531548bc072b604c0617e5ebcf7fc60b4
SHA1035e68c49525e477ca5e61f77e1f8fdd4955b722
SHA25617dc9571dbd7e094dd65a862adfcde7328a3c3e45c9053ba99bff638e7918b4e
SHA5129848a6406fa2b6ff3046dd147eb94583fb637a2598dc332905b2a98e171814d3d76554bcf54a909503577fab85ccccf29ae475f614edd3f30e0a62afe8696cb1
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b