Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 21:47
Behavioral task
behavioral1
Sample
24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe
Resource
win10v2004-20241007-en
General
-
Target
24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe
-
Size
1.3MB
-
MD5
929848b545e53abbf1262b10298fc370
-
SHA1
163118ef92d48df9ffd079c61b9e1ef772e22420
-
SHA256
24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5
-
SHA512
6a19ad7d038a79ba13b49fee3a099d3a64a7eea7abbd3cf63ff7bdf7faa0301b7bfbabdc0871277870fb9113f2982aca78ccc0fa498d9018a64e02ac3bf10851
-
SSDEEP
24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYJ:8u0c++OCvkGs9Fa+rd1f26RaYJ
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 6 IoCs
resource yara_rule behavioral1/files/0x0008000000012102-2.dat netwire behavioral1/memory/2444-23-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1316-45-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/files/0x00070000000190c6-46.dat netwire behavioral1/memory/1316-81-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1508-83-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral1/memory/2776-28-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2776-38-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/532-65-0x00000000000D0000-0x00000000000ED000-memory.dmp warzonerat behavioral1/memory/532-74-0x00000000000D0000-0x00000000000ED000-memory.dmp warzonerat -
Executes dropped EXE 11 IoCs
pid Process 2444 Blasthost.exe 1316 Host.exe 2000 RtDCpl64.exe 1508 Blasthost.exe 532 RtDCpl64.exe 1348 RtDCpl64.exe 1832 Blasthost.exe 1772 RtDCpl64.exe 2548 RtDCpl64.exe 1684 Blasthost.exe 2840 RtDCpl64.exe -
Loads dropped DLL 16 IoCs
pid Process 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 2444 Blasthost.exe 2444 Blasthost.exe 2000 RtDCpl64.exe 2000 RtDCpl64.exe 2000 RtDCpl64.exe 2000 RtDCpl64.exe 1348 RtDCpl64.exe 1348 RtDCpl64.exe 1348 RtDCpl64.exe 2548 RtDCpl64.exe 2548 RtDCpl64.exe 2548 RtDCpl64.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00070000000190c6-46.dat autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1752 set thread context of 2776 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 32 PID 2000 set thread context of 532 2000 RtDCpl64.exe 41 PID 1348 set thread context of 1772 1348 RtDCpl64.exe 48 PID 2548 set thread context of 2840 2548 RtDCpl64.exe 55 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1744 schtasks.exe 1724 schtasks.exe 2988 schtasks.exe 2692 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2444 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 30 PID 1752 wrote to memory of 2444 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 30 PID 1752 wrote to memory of 2444 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 30 PID 1752 wrote to memory of 2444 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 30 PID 2444 wrote to memory of 1316 2444 Blasthost.exe 31 PID 2444 wrote to memory of 1316 2444 Blasthost.exe 31 PID 2444 wrote to memory of 1316 2444 Blasthost.exe 31 PID 2444 wrote to memory of 1316 2444 Blasthost.exe 31 PID 1752 wrote to memory of 2776 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 32 PID 1752 wrote to memory of 2776 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 32 PID 1752 wrote to memory of 2776 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 32 PID 1752 wrote to memory of 2776 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 32 PID 1752 wrote to memory of 2776 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 32 PID 1752 wrote to memory of 2776 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 32 PID 1752 wrote to memory of 2988 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 33 PID 1752 wrote to memory of 2988 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 33 PID 1752 wrote to memory of 2988 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 33 PID 1752 wrote to memory of 2988 1752 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 33 PID 2776 wrote to memory of 2268 2776 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 35 PID 2776 wrote to memory of 2268 2776 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 35 PID 2776 wrote to memory of 2268 2776 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 35 PID 2776 wrote to memory of 2268 2776 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 35 PID 2776 wrote to memory of 2268 2776 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 35 PID 2776 wrote to memory of 2268 2776 24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe 35 PID 3064 wrote to memory of 2000 3064 taskeng.exe 39 PID 3064 wrote to memory of 2000 3064 taskeng.exe 39 PID 3064 wrote to memory of 2000 3064 taskeng.exe 39 PID 3064 wrote to memory of 2000 3064 taskeng.exe 39 PID 2000 wrote to memory of 1508 2000 RtDCpl64.exe 40 PID 2000 wrote to memory of 1508 2000 RtDCpl64.exe 40 PID 2000 wrote to memory of 1508 2000 RtDCpl64.exe 40 PID 2000 wrote to memory of 1508 2000 RtDCpl64.exe 40 PID 2000 wrote to memory of 532 2000 RtDCpl64.exe 41 PID 2000 wrote to memory of 532 2000 RtDCpl64.exe 41 PID 2000 wrote to memory of 532 2000 RtDCpl64.exe 41 PID 2000 wrote to memory of 532 2000 RtDCpl64.exe 41 PID 2000 wrote to memory of 532 2000 RtDCpl64.exe 41 PID 2000 wrote to memory of 532 2000 RtDCpl64.exe 41 PID 2000 wrote to memory of 2692 2000 RtDCpl64.exe 42 PID 2000 wrote to memory of 2692 2000 RtDCpl64.exe 42 PID 2000 wrote to memory of 2692 2000 RtDCpl64.exe 42 PID 2000 wrote to memory of 2692 2000 RtDCpl64.exe 42 PID 532 wrote to memory of 2448 532 RtDCpl64.exe 43 PID 532 wrote to memory of 2448 532 RtDCpl64.exe 43 PID 532 wrote to memory of 2448 532 RtDCpl64.exe 43 PID 532 wrote to memory of 2448 532 RtDCpl64.exe 43 PID 532 wrote to memory of 2448 532 RtDCpl64.exe 43 PID 532 wrote to memory of 2448 532 RtDCpl64.exe 43 PID 3064 wrote to memory of 1348 3064 taskeng.exe 46 PID 3064 wrote to memory of 1348 3064 taskeng.exe 46 PID 3064 wrote to memory of 1348 3064 taskeng.exe 46 PID 3064 wrote to memory of 1348 3064 taskeng.exe 46 PID 1348 wrote to memory of 1832 1348 RtDCpl64.exe 47 PID 1348 wrote to memory of 1832 1348 RtDCpl64.exe 47 PID 1348 wrote to memory of 1832 1348 RtDCpl64.exe 47 PID 1348 wrote to memory of 1832 1348 RtDCpl64.exe 47 PID 1348 wrote to memory of 1772 1348 RtDCpl64.exe 48 PID 1348 wrote to memory of 1772 1348 RtDCpl64.exe 48 PID 1348 wrote to memory of 1772 1348 RtDCpl64.exe 48 PID 1348 wrote to memory of 1772 1348 RtDCpl64.exe 48 PID 1348 wrote to memory of 1772 1348 RtDCpl64.exe 48 PID 1348 wrote to memory of 1772 1348 RtDCpl64.exe 48 PID 1348 wrote to memory of 1744 1348 RtDCpl64.exe 49 PID 1348 wrote to memory of 1744 1348 RtDCpl64.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe"C:\Users\Admin\AppData\Local\Temp\24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:1316
-
-
-
C:\Users\Admin\AppData\Local\Temp\24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe"C:\Users\Admin\AppData\Local\Temp\24ceecbc1211b45bb35eeff06d91c9e8b7bb2dcee3fa74a8a5965d8dc36fcff5N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2268
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2988
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D1093CF7-6C0C-47ED-948B-F2CD0AEAD999} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1508
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2692
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1832
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:856
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1744
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1684
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2112
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1724
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5c62505d7491f1e82cd479c132e6949d7
SHA155107d4005e1257665742c7ab30babece2385bf4
SHA256ac9ad9950553b4c41252866f6ad67c9c9af4cd6fd4fc6e67618dfc9cf8ec6740
SHA5120dc75b12c10d774e988d69f6ba565bf4c0f40b089dea1310b41a76322643b236db99a3ddaeefd2409acd8c890c21f3d825160c9439b1dfecaf25023ef4aa29cb
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292