Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
Product Specification Wire-Mesh RQF 260924.sc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Product Specification Wire-Mesh RQF 260924.sc.exe
Resource
win10v2004-20240802-en
General
-
Target
Product Specification Wire-Mesh RQF 260924.sc.exe
-
Size
480KB
-
MD5
aac338140e178a3cac423d3454cc7467
-
SHA1
a9c195e15b4109d4ece1309fb4e3b3bd77145421
-
SHA256
461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb
-
SHA512
a96b2c8c985feccbc385a8ba1e7583be6913db7da15244b136c203f7ca320a03727425f3927c21157eae0c4da3fbbdd8fb71373655c6824544296ec66df834f2
-
SSDEEP
12288:PkQNy5kuH2lZ6r4os6WQMiyvtJMDiXxJfrJyru:XvuHTr4J7Qw1JJXxJ0ru
Malware Config
Extracted
strrat
93.185.156.124:1912
127.0.0.1:1912
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2108 set thread context of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Product Specification Wire-Mesh RQF 260924.sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Product Specification Wire-Mesh RQF 260924.sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 2108 Product Specification Wire-Mesh RQF 260924.sc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2108 Product Specification Wire-Mesh RQF 260924.sc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 2108 wrote to memory of 1800 2108 Product Specification Wire-Mesh RQF 260924.sc.exe 30 PID 1800 wrote to memory of 1832 1800 Product Specification Wire-Mesh RQF 260924.sc.exe 31 PID 1800 wrote to memory of 1832 1800 Product Specification Wire-Mesh RQF 260924.sc.exe 31 PID 1800 wrote to memory of 1832 1800 Product Specification Wire-Mesh RQF 260924.sc.exe 31 PID 1800 wrote to memory of 1832 1800 Product Specification Wire-Mesh RQF 260924.sc.exe 31 PID 1832 wrote to memory of 2844 1832 cmd.exe 33 PID 1832 wrote to memory of 2844 1832 cmd.exe 33 PID 1832 wrote to memory of 2844 1832 cmd.exe 33 PID 1832 wrote to memory of 2844 1832 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Product Specification Wire-Mesh RQF 260924.sc.exe"C:\Users\Admin\AppData\Local\Temp\Product Specification Wire-Mesh RQF 260924.sc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\Product Specification Wire-Mesh RQF 260924.sc.exe"C:\Users\Admin\AppData\Local\Temp\Product Specification Wire-Mesh RQF 260924.sc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\A.jar"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\A.jar"4⤵PID:2844
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5105a14c6fce083e80f49b30db88ec915
SHA146187697a87562210e785917ce6ca16aeb4912b3
SHA2567e5adae008afee158168b1943fcc41157c7de63ab4792cc5eba8d1830edd6d65
SHA5122322eeeb100b644d53641ec3c1b0588579565636a2ea934924931f6f77b156b6d4e5925a2f36b0520e1f568d771860af53e9f3c39bb5238f7e7520389692c963