Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 00:41

General

  • Target

    2024-10-01_d6f5c3a7be8825eb337285bee85f1c86_poet-rat_snatch.exe

  • Size

    5.8MB

  • MD5

    d6f5c3a7be8825eb337285bee85f1c86

  • SHA1

    64824d37e73eeb72fe0df9220be724da6c98cf98

  • SHA256

    b53a1b4d997cb1bfaecfd17a8c136e40ac1d87b249c3eee1a30ec9e4eca9689a

  • SHA512

    e1160b9d303fad1e7b0792e805efe44aa0d0b160049dcd507792cdc9de90191def0dc92a3419ef567cadeaecc0cdffa22a9d5f1355cd57b4576c8d6c2fdc00df

  • SSDEEP

    49152:vzlnEcO3Cgrb/TbvO90d7HjmAFd4A64nsfJa/pJMBMvDF/4q4auspdkgKKhdvZfZ:63CE/Xx4LKhdk8ESp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-01_d6f5c3a7be8825eb337285bee85f1c86_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-01_d6f5c3a7be8825eb337285bee85f1c86_poet-rat_snatch.exe"
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Windows\system32\schtasks.exe
      C:\Windows\system32\schtasks.exe /CREATE /XML C:\Users\Admin\AppData\Local\Temp\KDCBNomUWRQxPtEju /F /TN ChromeUpdateTaskMachinCore
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4388
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3312
      • C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe
        "C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe

    Filesize

    5.8MB

    MD5

    1e1a8e288916bf1e396390b056f136ba

    SHA1

    e5f23a3449f6a9b2b75989fa156a72f72fc71254

    SHA256

    87c09945f12f696b46976fe700a17a95525e62434f8b57cc0c5291df32618717

    SHA512

    a9f49879ec0a9f562be05b92a52d4dada3db840c049036ad0655655ebf98d5956d453782c9c5cc75ee348da36ce30222171157b2c44fcd62fd2c91e5896a2ad3

  • C:\Users\Admin\AppData\Local\Temp\KDCBNomUWRQxPtEju

    Filesize

    1KB

    MD5

    c1e363572ba6f100cd276a2e8ef465df

    SHA1

    d184da401c9e58be5cdadeaafba7c37e5c1130b9

    SHA256

    2068be6246a142e8fb4dfda27801147b8c436562f96628f731e109dfb95ced6f

    SHA512

    7a25108df6e5987b7d069e9835969856ef1057267a2bd2735a5b9d7bf6b02e46a3873ff73021d2b21d52652f7b6636bee73cc873c4ccc46c96f0a3b6fd667f93