Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-10-04...ch.exe

windows7-x64

7

2024-10-04...ch.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 20:43 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-04_0f0110d252b12d284ca10bb52a23185c_poet-rat_snatch.exe

  • Size

    5.8MB

  • MD5

    0f0110d252b12d284ca10bb52a23185c

  • SHA1

    077128158af2c55d1574d20a0c8b6aa1a60fa086

  • SHA256

    479f8ddff1392fb73409730f0c5cdc2d3e133b60c515af94ba9a653e8cef7764

  • SHA512

    fa85f91e3ea1174511a2f6490250c4a38d1e4685a87f4342011bbcc1900abf3dfb6b5aac517091d1e0929fdb33cc7576d5f79f9967f6c64709cac31d4c7a4096

  • SSDEEP

    49152:vzlnEcO3Cgrb/TbvO90d7HjmAFd4A64nsfJa/pJMBMvDF/4q4auspdkgKKhdvZfN:63CE/Xx4LKhdkdESp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-04_0f0110d252b12d284ca10bb52a23185c_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-04_0f0110d252b12d284ca10bb52a23185c_poet-rat_snatch.exe"
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\system32\schtasks.exe
      C:\Windows\system32\schtasks.exe /CREATE /XML C:\Users\Admin\AppData\Local\Temp\fWZykz /F /TN ChromeUpdateTaskMachinCore
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3056
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe
        "C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        PID:2092

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    dist.torproject.org
    ChromeUpdateTaskMachinCore.exe
    Remote address:
    8.8.8.8:53
    Request
    dist.torproject.org
    IN A
    Response
    dist.torproject.org
    IN A
    116.202.120.165
    dist.torproject.org
    IN A
    116.202.120.166
    dist.torproject.org
    IN A
    204.8.99.146
    dist.torproject.org
    IN A
    204.8.99.144
  • flag-us
    DNS
    165.120.202.116.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    165.120.202.116.in-addr.arpa
    IN PTR
    Response
    165.120.202.116.in-addr.arpa
    IN PTR
    web-fsn-01 torprojectorg
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    dist.torproject.org
    ChromeUpdateTaskMachinCore.exe
    Remote address:
    8.8.8.8:53
    Request
    dist.torproject.org
    IN A
    Response
    dist.torproject.org
    IN A
    204.8.99.144
    dist.torproject.org
    IN A
    204.8.99.146
    dist.torproject.org
    IN A
    116.202.120.165
    dist.torproject.org
    IN A
    116.202.120.166
  • flag-us
    DNS
    144.99.8.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    144.99.8.204.in-addr.arpa
    IN PTR
    Response
    144.99.8.204.in-addr.arpa
    IN PTR
    web-dal-07 torprojectorg
  • 127.0.0.1:1337
    2024-10-04_0f0110d252b12d284ca10bb52a23185c_poet-rat_snatch.exe
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.9kB
     85.3kB
     113
    113
  • 127.0.0.1:1337
    ChromeUpdateTaskMachinCore.exe
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.9kB
     85.3kB
     113
    114
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.2kB
     85.5kB
     114
    116
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.0kB
     85.4kB
     113
    113
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.8kB
     85.3kB
     111
    112
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.2kB
     87.7kB
     114
    117
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.5kB
     86.3kB
     116
    117
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.2kB
     85.5kB
     114
    115
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.2kB
     86.1kB
     115
    114
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    26.8kB
     92.5kB
     131
    124
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    25.1kB
     88.5kB
     121
    117
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    26.1kB
     90.3kB
     127
    122
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    25.6kB
     90.1kB
     125
    120
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.1kB
     86.0kB
     114
    113
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.9kB
     85.3kB
     112
    113
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.0kB
     85.4kB
     113
    114
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.0kB
     85.4kB
     113
    114
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.8kB
     85.3kB
     111
    113
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.9kB
     85.3kB
     113
    113
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.0kB
     85.4kB
     113
    114
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.0kB
     85.4kB
     113
    114
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.6kB
     86.3kB
     117
    118
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.9kB
     85.3kB
     113
    114
  • 116.202.120.165:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.8kB
     87.0kB
     117
    116
  • 204.8.99.144:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    24.0kB
     85.4kB
     113
    114
  • 204.8.99.144:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    23.9kB
     85.3kB
     113
    113
  • 204.8.99.144:443
    dist.torproject.org
    tls
    ChromeUpdateTaskMachinCore.exe
    19.3kB
     69.3kB
     89
    91
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    dist.torproject.org
    dns
    ChromeUpdateTaskMachinCore.exe
    65 B
     129 B
     1
    1

    DNS Request

    dist.torproject.org

    DNS Response

    116.202.120.165
    116.202.120.166
    204.8.99.146
    204.8.99.144

  • 8.8.8.8:53
    165.120.202.116.in-addr.arpa
    dns
    74 B
     113 B
     1
    1

    DNS Request

    165.120.202.116.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    dist.torproject.org
    dns
    ChromeUpdateTaskMachinCore.exe
    65 B
     129 B
     1
    1

    DNS Request

    dist.torproject.org

    DNS Response

    204.8.99.144
    204.8.99.146
    116.202.120.165
    116.202.120.166

  • 8.8.8.8:53
    144.99.8.204.in-addr.arpa
    dns
    71 B
     110 B
     1
    1

    DNS Request

    144.99.8.204.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe
    Filesize

    5.8MB

    MD5

    864832a4770cc37e472be3cdd7de0c2f

    SHA1

    1d953626c915d83069d84852bf6445fcc727a931

    SHA256

    39ab365f806043a9307e3a85266d88885c3125e4a18df8112f0a99aa1e93000d

    SHA512

    1f8b477b061de2b79bb4dc708e0041e45d6f1b480ba25acbd9cf81c236ba80d56c37f44d6b38243953078edec063f29c5fb58181df545405da4e011036479754

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\fWZykz
    Filesize

    1KB

    MD5

    f7a3acf8a6d1ddbbe32c20c2a5186b57

    SHA1

    562f99982f12cbb01b1442eb6ddd77be5f7d0fe8

    SHA256

    91758ef395487a82d863fcac3f3c38d55664791ddde6bceaf1f851e49caf5576

    SHA512

    22e21088d51819915932690740451c1d56f5cf6a5bd33e29644510612a4112c091649b80e718522abaa58f19279481b4fbc3ba1a3ca2e2f370eca39f4607744d

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.