Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
Resource
win10v2004-20240910-en
General
-
Target
461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe
-
Size
480KB
-
MD5
aac338140e178a3cac423d3454cc7467
-
SHA1
a9c195e15b4109d4ece1309fb4e3b3bd77145421
-
SHA256
461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb
-
SHA512
a96b2c8c985feccbc385a8ba1e7583be6913db7da15244b136c203f7ca320a03727425f3927c21157eae0c4da3fbbdd8fb71373655c6824544296ec66df834f2
-
SSDEEP
12288:PkQNy5kuH2lZ6r4os6WQMiyvtJMDiXxJfrJyru:XvuHTr4J7Qw1JJXxJ0ru
Malware Config
Extracted
strrat
93.185.156.124:1912
127.0.0.1:1912
-
license_id
khonsari
-
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
-
scheduled_task
true
-
secondary_startup
true
-
startup
true
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2380 set thread context of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2972 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 30 PID 2380 wrote to memory of 2972 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 30 PID 2380 wrote to memory of 2972 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 30 PID 2380 wrote to memory of 2972 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 30 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2380 wrote to memory of 2484 2380 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 31 PID 2484 wrote to memory of 2808 2484 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 32 PID 2484 wrote to memory of 2808 2484 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 32 PID 2484 wrote to memory of 2808 2484 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 32 PID 2484 wrote to memory of 2808 2484 461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe 32 PID 2808 wrote to memory of 2800 2808 cmd.exe 34 PID 2808 wrote to memory of 2800 2808 cmd.exe 34 PID 2808 wrote to memory of 2800 2808 cmd.exe 34 PID 2808 wrote to memory of 2800 2808 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"2⤵PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"C:\Users\Admin\AppData\Local\Temp\461d7bbff67fa45958735a68976e83143b072eb35f2275086e99212d8fd165cb.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.execmd /c start "" "C:\Users\Admin\AppData\Local\Temp\A.jar"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\A.jar"4⤵PID:2800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5105a14c6fce083e80f49b30db88ec915
SHA146187697a87562210e785917ce6ca16aeb4912b3
SHA2567e5adae008afee158168b1943fcc41157c7de63ab4792cc5eba8d1830edd6d65
SHA5122322eeeb100b644d53641ec3c1b0588579565636a2ea934924931f6f77b156b6d4e5925a2f36b0520e1f568d771860af53e9f3c39bb5238f7e7520389692c963