Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 02:05
Behavioral task
behavioral1
Sample
0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
⌚/gssgsg.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
⌚/gssgsg.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
⌚/withrobot.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
⌚/withrobot.exe
Resource
win10v2004-20241007-en
General
-
Target
0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe
-
Size
13.8MB
-
MD5
59528f2fe5b0f3fa8dc4b39552b13250
-
SHA1
aad3b825d26a11fd6100011708b5b8a1b4877f83
-
SHA256
0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6
-
SHA512
5be6a290a806475ec45b27d5487ec508b98fb8cc2abf14abc5a618f847555ddc0dce8b21d167625dabe828b11903336040fa91c08b9de9c7e7299fc6c7c82e17
-
SSDEEP
196608:s7WP+V6eGTQu75LbenTh5gOGCg+jCp5nzc74SLSbETVF4JnRXb+2IyVa1QSLr0fU:saWV6eGFtWFHxWbSnJFgtbIHfLr252tB
Malware Config
Extracted
rhadamanthys
https://83.217.208.134/9fcc2685c3ccafd/1gjc75ih.m8duc
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Rhadamanthys family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3204 created 2656 3204 gssgsg.exe 44 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1888 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe -
Executes dropped EXE 2 IoCs
pid Process 3204 gssgsg.exe 2300 withrobot.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe withrobot.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5112 sc.exe 3512 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gssgsg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openwith.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3204 gssgsg.exe 3204 gssgsg.exe 4404 openwith.exe 4404 openwith.exe 4404 openwith.exe 4404 openwith.exe 2300 withrobot.exe 2300 withrobot.exe 2300 withrobot.exe 1888 powershell.exe 1888 powershell.exe 2300 withrobot.exe 2300 withrobot.exe 2300 withrobot.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1888 powershell.exe Token: SeDebugPrivilege 2300 withrobot.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 928 wrote to memory of 3204 928 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe 83 PID 928 wrote to memory of 3204 928 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe 83 PID 928 wrote to memory of 3204 928 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe 83 PID 928 wrote to memory of 2300 928 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe 84 PID 928 wrote to memory of 2300 928 0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe 84 PID 3204 wrote to memory of 4404 3204 gssgsg.exe 85 PID 3204 wrote to memory of 4404 3204 gssgsg.exe 85 PID 3204 wrote to memory of 4404 3204 gssgsg.exe 85 PID 3204 wrote to memory of 4404 3204 gssgsg.exe 85 PID 3204 wrote to memory of 4404 3204 gssgsg.exe 85 PID 1292 wrote to memory of 2828 1292 cmd.exe 106 PID 1292 wrote to memory of 2828 1292 cmd.exe 106
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2656
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4404
-
-
C:\Users\Admin\AppData\Local\Temp\0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe"C:\Users\Admin\AppData\Local\Temp\0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Roaming\gssgsg.exe"C:\Users\Admin\AppData\Roaming\gssgsg.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204
-
-
C:\Users\Admin\AppData\Roaming\withrobot.exe"C:\Users\Admin\AppData\Roaming\withrobot.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:2828
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "RuntimeBroker"3⤵
- Launches sc.exe
PID:5112
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "RuntimeBroker" binpath= "C:\ProgramData\RuntimeBroker.exe" start= "auto"3⤵
- Launches sc.exe
PID:3512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
423KB
MD5da861aca3a436392e0fcb1a1b5135727
SHA169d97208285a41cd9c3d6228ad1edc634cc3df0a
SHA256bc57668066ddb1ec774e502213af0b10c23d4a1f409199109617e750784c8410
SHA5127d0ff69678b337dce46fbb7e54f602e365bc4d9ba93c24b1dba5aee6a6040a410cefe66679ed8fb2e8cf633a1a72e37d2daf8005dfe54289ba5948e55d574957
-
Filesize
14.8MB
MD502071fe1b9c8d6ade8dafa0a71600503
SHA15b547e72386e43c291bceea5b7d0e8f51469cd3c
SHA25600c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf
SHA5121c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a