Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 18:36
Behavioral task
behavioral1
Sample
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe
Resource
win7-20240705-en
General
-
Target
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe
-
Size
74KB
-
MD5
c3f58ffd73d3afc5cc08a29dc5a864c8
-
SHA1
aad0a8c93043e3a4f7c422278c9c02a016ed55b7
-
SHA256
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2
-
SHA512
4d45d348bbbc2d503eea99c7265e68c6ce87cf8be982ba153c6e8e6c58484476fc4287a91f8cff2eaa3f4ff1de04e02b2b4bcb597326c6963b28967670fc50b7
-
SSDEEP
1536:EUgQcxI76jCsGPMV19BsmGYIek1bd/VgSQzceLVclN:EUVcxI7q3GPMVz9jk1bd9Q3BY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
119.59.98.116:7812
WindowsDefendersecurityService
-
delay
1
-
install
true
-
install_file
Windows Defender Security Service.exe
-
install_folder
%AppData%
Signatures
-
resource yara_rule behavioral2/memory/3912-1-0x0000000000E80000-0x0000000000E98000-memory.dmp VenomRAT behavioral2/files/0x00060000000226c6-12.dat VenomRAT -
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x00060000000226c6-12.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe -
Executes dropped EXE 1 IoCs
pid Process 348 Windows Defender Security Service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1272 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe 348 Windows Defender Security Service.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe Token: SeDebugPrivilege 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe Token: SeDebugPrivilege 348 Windows Defender Security Service.exe Token: SeDebugPrivilege 348 Windows Defender Security Service.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 348 Windows Defender Security Service.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3912 wrote to memory of 468 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 94 PID 3912 wrote to memory of 468 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 94 PID 3912 wrote to memory of 3832 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 96 PID 3912 wrote to memory of 3832 3912 27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe 96 PID 468 wrote to memory of 720 468 cmd.exe 98 PID 468 wrote to memory of 720 468 cmd.exe 98 PID 3832 wrote to memory of 1272 3832 cmd.exe 99 PID 3832 wrote to memory of 1272 3832 cmd.exe 99 PID 3832 wrote to memory of 348 3832 cmd.exe 104 PID 3832 wrote to memory of 348 3832 cmd.exe 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe"C:\Users\Admin\AppData\Local\Temp\27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Defender Security Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Windows Defender Security Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1E51.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1272
-
-
C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"C:\Users\Admin\AppData\Roaming\Windows Defender Security Service.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:348
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:81⤵PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178B
MD5a6f69129182dd21edb207722009933b6
SHA16c580a64c5e84cefd5c35f00728a10029214f2ad
SHA25671bf772b03b692b79c703ddeaa22335ba9568d13099f371256b72886f4636273
SHA512223e2f09682d49fa87f0412b8293f99ae157edccb485bcc5b3cc9b7e2f712741900c277020788bd74876215d319d5a9856e581afb289955c852f5e76544fcd6c
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
74KB
MD5c3f58ffd73d3afc5cc08a29dc5a864c8
SHA1aad0a8c93043e3a4f7c422278c9c02a016ed55b7
SHA25627d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2
SHA5124d45d348bbbc2d503eea99c7265e68c6ce87cf8be982ba153c6e8e6c58484476fc4287a91f8cff2eaa3f4ff1de04e02b2b4bcb597326c6963b28967670fc50b7