Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/12/2024, 17:14
Behavioral task
behavioral1
Sample
newClient.exe
Resource
win7-20240903-en
General
-
Target
newClient.exe
-
Size
63KB
-
MD5
850f69a366c31db03ec8712b336f9fbd
-
SHA1
9afdce442ef056c44cab85027b80d0f56bb65f79
-
SHA256
1ad7ca994dc657ad56db324539251cacc030481d894351dd9e28575afd67c265
-
SHA512
ef7014b9d8fb39dabea401d7acc9fd9c55c6aa1900c47743f6ae733dc71a2feaee5eccec0148bd6b9bb9edef681f9d5c0ac1c3d872b7cd02941047920731b28b
-
SSDEEP
1536:F8iDBlH6vPpRjK0GbbRwVHv+Kr7qG7FZVclN:amlH6vPLjnGbbR62KPzY
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:7707
127.0.0.1:31576
yeswasdwasdwasd-31576.portmap.host:7707
yeswasdwasdwasd-31576.portmap.host:31576
roaroaroaraoroaroaraoraoraoarororrohrorororoaroaaoaoaoaroaroar
-
delay
1
-
install
true
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023b5a-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation newClient.exe -
Executes dropped EXE 1 IoCs
pid Process 3452 windows defender firewall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3228 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3744 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe 3908 newClient.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3908 newClient.exe Token: SeDebugPrivilege 3452 windows defender firewall.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3908 wrote to memory of 1928 3908 newClient.exe 82 PID 3908 wrote to memory of 1928 3908 newClient.exe 82 PID 3908 wrote to memory of 4436 3908 newClient.exe 84 PID 3908 wrote to memory of 4436 3908 newClient.exe 84 PID 4436 wrote to memory of 3228 4436 cmd.exe 86 PID 4436 wrote to memory of 3228 4436 cmd.exe 86 PID 1928 wrote to memory of 3744 1928 cmd.exe 87 PID 1928 wrote to memory of 3744 1928 cmd.exe 87 PID 4436 wrote to memory of 3452 4436 cmd.exe 88 PID 4436 wrote to memory of 3452 4436 cmd.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\newClient.exe"C:\Users\Admin\AppData\Local\Temp\newClient.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:3744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp84FF.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3228
-
-
C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD51276defd260c610395a1e3d449afa8ab
SHA1722b8b0d1c0911738abff75d30af0dc1508068fd
SHA25643aa0d396df03f6f61acf6344d85500347311cd3f855c0bfac92230e9c6e3eb1
SHA51226adc6fdac9c4b904d627260cacc7cb40283111a00c7bac99e17cc69729581130a6aa1b9e3de22e884f5b8995eab6f6f25cb0367cd8d148e4b71fa038b73f8e6
-
Filesize
63KB
MD5850f69a366c31db03ec8712b336f9fbd
SHA19afdce442ef056c44cab85027b80d0f56bb65f79
SHA2561ad7ca994dc657ad56db324539251cacc030481d894351dd9e28575afd67c265
SHA512ef7014b9d8fb39dabea401d7acc9fd9c55c6aa1900c47743f6ae733dc71a2feaee5eccec0148bd6b9bb9edef681f9d5c0ac1c3d872b7cd02941047920731b28b