Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07/12/2024, 15:34
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20241010-en
General
-
Target
Client.exe
-
Size
48KB
-
MD5
77ca225fb7c84aad1e8ee9ead0110b4c
-
SHA1
b26e40f8e945f4db6621d7ca5a575a84c0565f91
-
SHA256
716b12fa63c467b57e24182ae3af25b738fc589f3f4f0aa5c516190f3eefbf00
-
SHA512
e8f2138cd82714ba58a30d9b48c7e61a6c42b17db297c332e078db544575404382ccf16dbd5bd0aced9342186b05b65a1da0426062b10729a40123a5887e3bbb
-
SSDEEP
768:ywpRILv+sx+LiEtelDSN+iV08YbygeYslsoo7RSYFr0bvEgK/JfZVc6KN:ywcpEtKDs4zb10rqjF4nkJfZVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
127.0.0.1:59953
fojeweb571-59953.portmap.host:8848
fojeweb571-59953.portmap.host:59953
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
windows defender firewall required.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000d000000012257-14.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2832 windows defender firewall required.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2752 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2440 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 576 Client.exe 576 Client.exe 576 Client.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 576 Client.exe Token: SeDebugPrivilege 2832 windows defender firewall required.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 576 wrote to memory of 2300 576 Client.exe 31 PID 576 wrote to memory of 2300 576 Client.exe 31 PID 576 wrote to memory of 2300 576 Client.exe 31 PID 576 wrote to memory of 768 576 Client.exe 33 PID 576 wrote to memory of 768 576 Client.exe 33 PID 576 wrote to memory of 768 576 Client.exe 33 PID 2300 wrote to memory of 2440 2300 cmd.exe 35 PID 2300 wrote to memory of 2440 2300 cmd.exe 35 PID 2300 wrote to memory of 2440 2300 cmd.exe 35 PID 768 wrote to memory of 2752 768 cmd.exe 36 PID 768 wrote to memory of 2752 768 cmd.exe 36 PID 768 wrote to memory of 2752 768 cmd.exe 36 PID 768 wrote to memory of 2832 768 cmd.exe 37 PID 768 wrote to memory of 2832 768 cmd.exe 37 PID 768 wrote to memory of 2832 768 cmd.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall required" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall required.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall required" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall required.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2440
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDC3B.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2752
-
-
C:\Users\Admin\AppData\Roaming\windows defender firewall required.exe"C:\Users\Admin\AppData\Roaming\windows defender firewall required.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178B
MD571bab9dfe37f64ad942d0e644f0dd796
SHA1768529fa34785f77ec4a581b644d6c65864909b6
SHA2567ec1ef2f0efd4de49c35afca40e2dd51cdbe78ba09c770277964f072fb2f7b24
SHA512c9b7578f47af0b7e60050610204315232678b544e8443a84a3c3d3e8cd7f6186c77b0564cfa281f3b4c65a7ec74388638aa6a9ccb6ca287df8a49ecd26a8e6ff
-
Filesize
48KB
MD577ca225fb7c84aad1e8ee9ead0110b4c
SHA1b26e40f8e945f4db6621d7ca5a575a84c0565f91
SHA256716b12fa63c467b57e24182ae3af25b738fc589f3f4f0aa5c516190f3eefbf00
SHA512e8f2138cd82714ba58a30d9b48c7e61a6c42b17db297c332e078db544575404382ccf16dbd5bd0aced9342186b05b65a1da0426062b10729a40123a5887e3bbb