Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/12/2024, 17:16
Behavioral task
behavioral1
Sample
newClient.exe
Resource
win7-20241010-en
General
-
Target
newClient.exe
-
Size
63KB
-
MD5
850f69a366c31db03ec8712b336f9fbd
-
SHA1
9afdce442ef056c44cab85027b80d0f56bb65f79
-
SHA256
1ad7ca994dc657ad56db324539251cacc030481d894351dd9e28575afd67c265
-
SHA512
ef7014b9d8fb39dabea401d7acc9fd9c55c6aa1900c47743f6ae733dc71a2feaee5eccec0148bd6b9bb9edef681f9d5c0ac1c3d872b7cd02941047920731b28b
-
SSDEEP
1536:F8iDBlH6vPpRjK0GbbRwVHv+Kr7qG7FZVclN:amlH6vPLjnGbbR62KPzY
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:7707
127.0.0.1:31576
yeswasdwasdwasd-31576.portmap.host:7707
yeswasdwasdwasd-31576.portmap.host:31576
roaroaroaraoroaroaraoraoraoarororrohrorororoaroaaoaoaoaroaroar
-
delay
1
-
install
true
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000b00000001225c-15.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2136 windows defender firewall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2656 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2900 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2208 newClient.exe 2208 newClient.exe 2208 newClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2208 newClient.exe Token: SeDebugPrivilege 2136 windows defender firewall.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2456 2208 newClient.exe 30 PID 2208 wrote to memory of 2456 2208 newClient.exe 30 PID 2208 wrote to memory of 2456 2208 newClient.exe 30 PID 2208 wrote to memory of 2888 2208 newClient.exe 32 PID 2208 wrote to memory of 2888 2208 newClient.exe 32 PID 2208 wrote to memory of 2888 2208 newClient.exe 32 PID 2456 wrote to memory of 2900 2456 cmd.exe 33 PID 2456 wrote to memory of 2900 2456 cmd.exe 33 PID 2456 wrote to memory of 2900 2456 cmd.exe 33 PID 2888 wrote to memory of 2656 2888 cmd.exe 35 PID 2888 wrote to memory of 2656 2888 cmd.exe 35 PID 2888 wrote to memory of 2656 2888 cmd.exe 35 PID 2888 wrote to memory of 2136 2888 cmd.exe 36 PID 2888 wrote to memory of 2136 2888 cmd.exe 36 PID 2888 wrote to memory of 2136 2888 cmd.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\newClient.exe"C:\Users\Admin\AppData\Local\Temp\newClient.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2900
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8066.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2656
-
-
C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD53e9ef259253a93212b30eed9d2c53e87
SHA13eca97a9a2f199c851c840616c724f39619c97c8
SHA25660f63794e9c82325b1836ff0e95beb49821d72bff36a3787fe41e17fc71345e1
SHA512c59701fc6f0d31a155180336dfbeb54cf25fadbe58dd7b45a11ed2e1b5a7ec2946be93e56adde840c351b606a12d1cbe21ed8a6ec888b4530f256729e552aa48
-
Filesize
63KB
MD5850f69a366c31db03ec8712b336f9fbd
SHA19afdce442ef056c44cab85027b80d0f56bb65f79
SHA2561ad7ca994dc657ad56db324539251cacc030481d894351dd9e28575afd67c265
SHA512ef7014b9d8fb39dabea401d7acc9fd9c55c6aa1900c47743f6ae733dc71a2feaee5eccec0148bd6b9bb9edef681f9d5c0ac1c3d872b7cd02941047920731b28b