Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 14:32 UTC

General

  • Target

    acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe

  • Size

    17KB

  • MD5

    af48897e401a79baf8086585c18cf8fe

  • SHA1

    44e9a2699d07cbba45493000287ab5dfbe86df77

  • SHA256

    acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595

  • SHA512

    c65d348d3225e86909e33e9ef9717be72ea7f934b673f82748907f927c459c39e739dcb3ebcfc029b3fdd81d7a528cd2a025d01b28ded04a604a6375b13b8ea1

  • SSDEEP

    192:NWnNnAi9HEsjSXOLqaJN5MoiwH7abHG+jR9nsVVI+2ky0C+2c:NWnJ9HaOEoiwH7ab9sVK+2ky0C+2c

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • RevengeRat Executable 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
    "C:\Users\Admin\AppData\Local\Temp\acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\IMD.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\IMD.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vtkrsvlo.cmdline"
        3⤵
        • Drops startup file
        • Suspicious use of WriteProcessMemory
        PID:2368
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DF4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2DF3.tmp"
          4⤵
            PID:1392

    Network

    • flag-us
      DNS
      tzii.myq-see.com
      IMD.exe
      Remote address:
      8.8.8.8:53
      Request
      tzii.myq-see.com
      IN A
      Response
      tzii.myq-see.com
      IN A
      208.91.197.132
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      120 B
      3
      3
    • 208.91.197.132:888
      tzii.myq-see.com
      IMD.exe
      152 B
      40 B
      3
      1
    • 8.8.8.8:53
      tzii.myq-see.com
      dns
      IMD.exe
      62 B
      78 B
      1
      1

      DNS Request

      tzii.myq-see.com

      DNS Response

      208.91.197.132

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES2DF4.tmp

      Filesize

      1KB

      MD5

      f2b0119e4b1761418e6091ef38ddd60c

      SHA1

      c61fd92fb50a6ba4539df646ec1a4bbd688aa7e4

      SHA256

      908180691e2009a500cc77d9fb4a442509d5f35b0bfe5219d8d9e3443698c7e1

      SHA512

      53f21b925688c483335b471173fba888b99f05f04908a21f29034d818d076e6401e2df5c52ee9d631520bcaff143a97f28c130138e0c6e5c11d2f3102c9749d3

    • C:\Users\Admin\AppData\Local\Temp\vbc2DF3.tmp

      Filesize

      628B

      MD5

      f4204a25f9fd3b86c1af2514bee21827

      SHA1

      f8ba207bc7b2cc6b0f5f5d43284019f78ca72e68

      SHA256

      38aa7f22bdb395980c540ec2057562e5678607f8c573c82a68c074d3445b3fc4

      SHA512

      240a811734eecc6c48ebcbf6f39b4afc1d3398e248ba7062f2eba2b2e44a9d28a526aeef40dff833e2eaed286209668d926e50fd1b9f3b4e5bd2704c938733d3

    • C:\Users\Admin\AppData\Local\Temp\vtkrsvlo.0.vb

      Filesize

      175B

      MD5

      766a80b102cc61cdfdef05f5d41ecf49

      SHA1

      8fc5687cf17d514917cb83ecb78a319b64c2017f

      SHA256

      70b93e450b765949ac432258843141724da8f4979079e124aa80f0f9f1e4e14e

      SHA512

      975aead67d67998e892f7e446d3b86b014f89a0aba3aecc77d596f56eef2f45c8b7c1cc161e7a6c911b07074391a8cb74dae50d61d6dd8905866d83730a10003

    • C:\Users\Admin\AppData\Local\Temp\vtkrsvlo.cmdline

      Filesize

      191B

      MD5

      25f550d9416aba558fec2adaf3245238

      SHA1

      bb881916e40dc405f23f648b3caddcfbff5a4013

      SHA256

      571ec01caf0c19eb4bc99bfdce03b08ca740b0d1a2f8cb1f77b0e577dd9e69fa

      SHA512

      b0e5ba7fb74cd464cb55854329ea3ad0e5405e7d34b3cb3750d8653c48fe40e7f26b40772ddac98fffae6773d3a0d28df1b0c3a35096a9950f87eb7d0d8ee802

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\IMD.exe

      Filesize

      17KB

      MD5

      af48897e401a79baf8086585c18cf8fe

      SHA1

      44e9a2699d07cbba45493000287ab5dfbe86df77

      SHA256

      acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595

      SHA512

      c65d348d3225e86909e33e9ef9717be72ea7f934b673f82748907f927c459c39e739dcb3ebcfc029b3fdd81d7a528cd2a025d01b28ded04a604a6375b13b8ea1

    • memory/2196-12-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2196-0-0x000007FEF642E000-0x000007FEF642F000-memory.dmp

      Filesize

      4KB

    • memory/2196-4-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2196-3-0x000007FEF642E000-0x000007FEF642F000-memory.dmp

      Filesize

      4KB

    • memory/2196-2-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2196-1-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2548-14-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2548-13-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2548-15-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    • memory/2548-16-0x000007FEF6170000-0x000007FEF6B0D000-memory.dmp

      Filesize

      9.6MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.