Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2024, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL/001 COPIA DE LA NOTIFICACION.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL/001 COPIA DE LA NOTIFICACION.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL/CI.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL/CI.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL/info.htm
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL/info.htm
Resource
win10v2004-20241007-en
General
-
Target
002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL/001 COPIA DE LA NOTIFICACION.exe
-
Size
4.6MB
-
MD5
ae2a273bd3297d0abe74f940f76575a8
-
SHA1
73a8eaff4cb01bc03826bc90e7bd5f658bf2f5ac
-
SHA256
1fd92aa46464f8453e33dc7461f80ee7b441f9042e9d0110086226c5f725bd9f
-
SHA512
233e8d400138a72a2c64dcfcc0212e771c51d49a499e6a607b2b5a6ff4582fef05ebf551380193a5d00f9179e2b431ddc25a7e556a2857704008a4f5d3a2455a
-
SSDEEP
98304:nXTE4R/w8VGgIW7ZLl3F2xXFHOBe1gORB9O:nXTE4RnQWBl3MgOE
Malware Config
Extracted
asyncrat
| CRACKED BY https://t.me/xworm_v2
Default
ansynov25.duckdns.org:1415
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1864 set thread context of 2168 1864 001 COPIA DE LA NOTIFICACION.exe 83 PID 2168 set thread context of 1272 2168 cmd.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 001 COPIA DE LA NOTIFICACION.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1864 001 COPIA DE LA NOTIFICACION.exe 1864 001 COPIA DE LA NOTIFICACION.exe 2168 cmd.exe 2168 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1864 001 COPIA DE LA NOTIFICACION.exe 2168 cmd.exe 2168 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1272 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2168 1864 001 COPIA DE LA NOTIFICACION.exe 83 PID 1864 wrote to memory of 2168 1864 001 COPIA DE LA NOTIFICACION.exe 83 PID 1864 wrote to memory of 2168 1864 001 COPIA DE LA NOTIFICACION.exe 83 PID 1864 wrote to memory of 2168 1864 001 COPIA DE LA NOTIFICACION.exe 83 PID 2168 wrote to memory of 1272 2168 cmd.exe 102 PID 2168 wrote to memory of 1272 2168 cmd.exe 102 PID 2168 wrote to memory of 1272 2168 cmd.exe 102 PID 2168 wrote to memory of 1272 2168 cmd.exe 102 PID 2168 wrote to memory of 1272 2168 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL\001 COPIA DE LA NOTIFICACION.exe"C:\Users\Admin\AppData\Local\Temp\002-ENVIO COIPIA DE LA NOTIFICACION DEMANDA JUZGADO PENAL DE CIRCUITO RAMA JUDICIAL\001 COPIA DE LA NOTIFICACION.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
777KB
MD50b7c3430cba6b2ea6e9feac2d08b2864
SHA1380e21a0d5ca190a1954cf2497799ba768c9b0ff
SHA25613fcf4b8e4fbd0c4263d9033b88721e204ccfe1f4188b71b4d9703d3b2949214
SHA512802663d52bc66c4f1808f761924c0ea09e8b90930604306269fec99bec161fee9a246f9fe2e81e20520f5fa8a1d7004b837fbdc449d354698a84bf12eaa4455a