Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/12/2024, 17:14
Behavioral task
behavioral1
Sample
newClient.exe
Resource
win7-20240903-en
General
-
Target
newClient.exe
-
Size
63KB
-
MD5
850f69a366c31db03ec8712b336f9fbd
-
SHA1
9afdce442ef056c44cab85027b80d0f56bb65f79
-
SHA256
1ad7ca994dc657ad56db324539251cacc030481d894351dd9e28575afd67c265
-
SHA512
ef7014b9d8fb39dabea401d7acc9fd9c55c6aa1900c47743f6ae733dc71a2feaee5eccec0148bd6b9bb9edef681f9d5c0ac1c3d872b7cd02941047920731b28b
-
SSDEEP
1536:F8iDBlH6vPpRjK0GbbRwVHv+Kr7qG7FZVclN:amlH6vPLjnGbbR62KPzY
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:7707
127.0.0.1:31576
yeswasdwasdwasd-31576.portmap.host:7707
yeswasdwasdwasd-31576.portmap.host:31576
roaroaroaraoroaroaraoraoraoarororrohrorororoaroaaoaoaoaroaroar
-
delay
1
-
install
true
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0009000000016de9-15.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2816 windows defender firewall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2692 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1576 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2848 newClient.exe 2848 newClient.exe 2848 newClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2848 newClient.exe Token: SeDebugPrivilege 2816 windows defender firewall.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2848 wrote to memory of 1148 2848 newClient.exe 31 PID 2848 wrote to memory of 1148 2848 newClient.exe 31 PID 2848 wrote to memory of 1148 2848 newClient.exe 31 PID 1148 wrote to memory of 1576 1148 cmd.exe 33 PID 1148 wrote to memory of 1576 1148 cmd.exe 33 PID 1148 wrote to memory of 1576 1148 cmd.exe 33 PID 2848 wrote to memory of 2320 2848 newClient.exe 34 PID 2848 wrote to memory of 2320 2848 newClient.exe 34 PID 2848 wrote to memory of 2320 2848 newClient.exe 34 PID 2320 wrote to memory of 2692 2320 cmd.exe 36 PID 2320 wrote to memory of 2692 2320 cmd.exe 36 PID 2320 wrote to memory of 2692 2320 cmd.exe 36 PID 2320 wrote to memory of 2816 2320 cmd.exe 37 PID 2320 wrote to memory of 2816 2320 cmd.exe 37 PID 2320 wrote to memory of 2816 2320 cmd.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\newClient.exe"C:\Users\Admin\AppData\Local\Temp\newClient.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:1576
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDBED.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2692
-
-
C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD58da758506c4d1c379518a33a0e31ec08
SHA15a84f1e5b17ed3e21e54c8a46adc564876939ead
SHA2561d3d87cf91efc7767b969967b4011fba4309f5fe306eb7b2b604341f9abbef47
SHA51264516d111b040f0109fb1cdd49fffa41560ca361d563b0ea26d03069444e1a3ffb72a429ed5d4b5fd71d7165084acf439ffe545794c733a8887900e92d2cd7e6
-
Filesize
63KB
MD5850f69a366c31db03ec8712b336f9fbd
SHA19afdce442ef056c44cab85027b80d0f56bb65f79
SHA2561ad7ca994dc657ad56db324539251cacc030481d894351dd9e28575afd67c265
SHA512ef7014b9d8fb39dabea401d7acc9fd9c55c6aa1900c47743f6ae733dc71a2feaee5eccec0148bd6b9bb9edef681f9d5c0ac1c3d872b7cd02941047920731b28b