Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2024, 09:30

General

  • Target

    fd6b9a4e42648347bcfcdeb2d5e7f4b602364d22d70dcf79f1bdbf4722af96a6.exe

  • Size

    192KB

  • MD5

    0725580895dbf96decb73d2347c1bfc7

  • SHA1

    714a98668b4a18ee2e65711f2d835a14feaabee8

  • SHA256

    fd6b9a4e42648347bcfcdeb2d5e7f4b602364d22d70dcf79f1bdbf4722af96a6

  • SHA512

    18824d545374946fadfa2efc1a7f4137c5a7a131fa582cd177a61932f36f19ddaed1f4addf2e9971bec9c4151c00028956f83fac4e227264ea396bd3cccba03f

  • SSDEEP

    6144:H4FF5HbInVW5GJZ2tNYLj8MfsimYwYdlSk:H4+VzYKj86sgR1

Malware Config

Signatures

  • Detect XtremeRAT payload 3 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Xtremerat family
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd6b9a4e42648347bcfcdeb2d5e7f4b602364d22d70dcf79f1bdbf4722af96a6.exe
    "C:\Users\Admin\AppData\Local\Temp\fd6b9a4e42648347bcfcdeb2d5e7f4b602364d22d70dcf79f1bdbf4722af96a6.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\fd6b9a4e42648347bcfcdeb2d5e7f4b602364d22d70dcf79f1bdbf4722af96a6.exe
      "C:\Users\Admin\AppData\Local\Temp\fd6b9a4e42648347bcfcdeb2d5e7f4b602364d22d70dcf79f1bdbf4722af96a6.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2640
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1860-20-0x0000000002660000-0x0000000002661000-memory.dmp

      Filesize

      4KB

    • memory/1860-19-0x0000000002630000-0x0000000002631000-memory.dmp

      Filesize

      4KB

    • memory/1860-0-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/1860-1-0x00000000024A0000-0x00000000024A1000-memory.dmp

      Filesize

      4KB

    • memory/1860-33-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/1860-2-0x00000000024A0000-0x00000000024A1000-memory.dmp

      Filesize

      4KB

    • memory/1860-3-0x00000000024A0000-0x00000000024A1000-memory.dmp

      Filesize

      4KB

    • memory/1860-29-0x00000000004A0000-0x00000000004A1000-memory.dmp

      Filesize

      4KB

    • memory/1860-28-0x00000000024B0000-0x00000000024B1000-memory.dmp

      Filesize

      4KB

    • memory/1860-27-0x0000000000550000-0x0000000000551000-memory.dmp

      Filesize

      4KB

    • memory/1860-26-0x00000000026B0000-0x00000000026B1000-memory.dmp

      Filesize

      4KB

    • memory/1860-25-0x0000000002690000-0x0000000002691000-memory.dmp

      Filesize

      4KB

    • memory/1860-24-0x00000000026A0000-0x00000000026A1000-memory.dmp

      Filesize

      4KB

    • memory/1860-23-0x0000000002670000-0x0000000002671000-memory.dmp

      Filesize

      4KB

    • memory/1860-22-0x0000000002680000-0x0000000002681000-memory.dmp

      Filesize

      4KB

    • memory/1860-21-0x0000000002650000-0x0000000002651000-memory.dmp

      Filesize

      4KB

    • memory/1860-4-0x00000000024A0000-0x00000000024A3000-memory.dmp

      Filesize

      12KB

    • memory/1860-8-0x00000000024F0000-0x00000000024F1000-memory.dmp

      Filesize

      4KB

    • memory/1860-18-0x0000000002640000-0x0000000002641000-memory.dmp

      Filesize

      4KB

    • memory/1860-17-0x00000000004B0000-0x00000000004B1000-memory.dmp

      Filesize

      4KB

    • memory/1860-16-0x00000000004C0000-0x00000000004C1000-memory.dmp

      Filesize

      4KB

    • memory/1860-15-0x0000000000480000-0x0000000000481000-memory.dmp

      Filesize

      4KB

    • memory/1860-14-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB

    • memory/1860-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/1860-12-0x00000000024C0000-0x00000000024C1000-memory.dmp

      Filesize

      4KB

    • memory/1860-11-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/1860-10-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/1860-9-0x00000000003D0000-0x00000000003E0000-memory.dmp

      Filesize

      64KB

    • memory/1860-7-0x0000000002620000-0x0000000002621000-memory.dmp

      Filesize

      4KB

    • memory/2600-42-0x0000000000C80000-0x0000000000C96000-memory.dmp

      Filesize

      88KB

    • memory/2600-38-0x0000000000C80000-0x0000000000C96000-memory.dmp

      Filesize

      88KB

    • memory/2600-40-0x0000000000C80000-0x0000000000C96000-memory.dmp

      Filesize

      88KB

    • memory/2964-30-0x0000000000C80000-0x0000000000C96000-memory.dmp

      Filesize

      88KB

    • memory/2964-32-0x0000000000C80000-0x0000000000C96000-memory.dmp

      Filesize

      88KB

    • memory/2964-34-0x0000000000C80000-0x0000000000C96000-memory.dmp

      Filesize

      88KB