Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe
Resource
win7-20240903-en
General
-
Target
9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe
-
Size
1.7MB
-
MD5
846fd69ecb7c442c7ab51f3174bac26a
-
SHA1
cd266cfb8b0ce0878ca57f1762579a7ab4da48f0
-
SHA256
9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4
-
SHA512
69912b20e8b9aed8556248704fafc8f02a3203b6f8f7cf14809d19bce816305a393d908c600fa403eed16e30fcbc7249c14fd214f67095b8dd9ecae3f73c93e7
-
SSDEEP
49152:dQZAdVyVT9n/Gg0P+WhorKTKK4KKDyK5kZ1EEEEmEEE1EEEEEEEEEEEQKK1KKK1u:GGdVyVT9nOgmhuKTKK4KKDyK5kZ1EEE8
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2872-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2872-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2872-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3988-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3988-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3988-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3988-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2248-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2248-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2248-74-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2248-80-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
resource yara_rule behavioral2/memory/2872-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2872-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2872-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3988-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3988-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3988-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3988-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/files/0x0007000000023506-36.dat family_gh0strat behavioral2/memory/2248-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2248-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2248-74-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2248-80-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240632437.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
pid Process 2872 svchost.exe 3988 TXPlatforn.exe 2248 TXPlatforn.exe 3876 svchos.exe 2008 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
pid Process 3876 svchos.exe 920 svchost.exe 2008 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
resource yara_rule behavioral2/memory/2872-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2872-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2872-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2872-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3988-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3988-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3988-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3988-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3988-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2248-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2248-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2248-74-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2248-80-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240632437.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatforn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4136 cmd.exe 3052 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3052 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2248 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: SeLoadDriverPrivilege 2248 TXPlatforn.exe Token: 33 2248 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2248 TXPlatforn.exe Token: 33 2248 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2248 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1096 wrote to memory of 2872 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe 82 PID 1096 wrote to memory of 2872 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe 82 PID 1096 wrote to memory of 2872 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe 82 PID 2872 wrote to memory of 4136 2872 svchost.exe 84 PID 2872 wrote to memory of 4136 2872 svchost.exe 84 PID 2872 wrote to memory of 4136 2872 svchost.exe 84 PID 3988 wrote to memory of 2248 3988 TXPlatforn.exe 85 PID 3988 wrote to memory of 2248 3988 TXPlatforn.exe 85 PID 3988 wrote to memory of 2248 3988 TXPlatforn.exe 85 PID 1096 wrote to memory of 3876 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe 86 PID 1096 wrote to memory of 3876 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe 86 PID 1096 wrote to memory of 3876 1096 9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe 86 PID 4136 wrote to memory of 3052 4136 cmd.exe 90 PID 4136 wrote to memory of 3052 4136 cmd.exe 90 PID 4136 wrote to memory of 3052 4136 cmd.exe 90 PID 920 wrote to memory of 2008 920 svchost.exe 95 PID 920 wrote to memory of 2008 920 svchost.exe 95 PID 920 wrote to memory of 2008 920 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe"C:\Users\Admin\AppData\Local\Temp\9460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3052
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3876
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2164
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240632437.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2008
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5846fd69ecb7c442c7ab51f3174bac26a
SHA1cd266cfb8b0ce0878ca57f1762579a7ab4da48f0
SHA2569460c89e97b4918ab745fc6e013cfd904bc8c8aff1c7a53d850bd94dbb8823d4
SHA51269912b20e8b9aed8556248704fafc8f02a3203b6f8f7cf14809d19bce816305a393d908c600fa403eed16e30fcbc7249c14fd214f67095b8dd9ecae3f73c93e7
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD5c14f7b74a0dc0df832f5b18af3eb7600
SHA1fe5d1fc7dcb19f9fb41831571c8347662de4dfc2
SHA2569f673b7a00d7e7d41336c1abe15abd96562229a2f7c59794d6425efcd680bb13
SHA5124f993b34b83330af8d2c66131103563b15d5ce6543e588a96597a5c32141f67523fd6f8ddd6f14b4274c58fa0a8601243de80dd315c3a1a18bab1879729f37df
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641