Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/12/2024, 20:51
Behavioral task
behavioral1
Sample
Client.exe
Resource
win10v2004-20241007-en
General
-
Target
Client.exe
-
Size
63KB
-
MD5
4ae421ab5dc26aad7211a5bcc6ae89f2
-
SHA1
90f1c09a58087d15688db7bf63ae889d8b453751
-
SHA256
884eacb6f51be1e6eba1296aece06baccd3f600f258494fef2dfcc34fd257ccd
-
SHA512
0b9689d6718749b03a38d3f681cb62f70eb96438a24ad0ca0177ffa53c70bebe8bc3e28ef46df5165baaf11a876df3fe27f5ece785f748ac2b467d79a51eb1c2
-
SSDEEP
768:a2C46poI3iPgqUi79JKWcXveeObMbNCl1+6SCv7mqb2nIpwH1oV7Go8GdZVc6KN:aEIo5neeiMl8GbbXwZGdZVclN
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
127.0.0.1:54817
roaroaroaraoroaroaraoraoraoarororrohrorororoaroaaoaoaoaroaroar
-
delay
1
-
install
true
-
install_file
windows defender firewall.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x001c00000002aa6d-11.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 3680 windows defender firewall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3616 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe 2748 Client.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2748 Client.exe Token: SeDebugPrivilege 3680 windows defender firewall.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2748 wrote to memory of 1412 2748 Client.exe 77 PID 2748 wrote to memory of 1412 2748 Client.exe 77 PID 2748 wrote to memory of 4268 2748 Client.exe 79 PID 2748 wrote to memory of 4268 2748 Client.exe 79 PID 4268 wrote to memory of 3616 4268 cmd.exe 81 PID 4268 wrote to memory of 3616 4268 cmd.exe 81 PID 1412 wrote to memory of 4792 1412 cmd.exe 82 PID 1412 wrote to memory of 4792 1412 cmd.exe 82 PID 4268 wrote to memory of 3680 4268 cmd.exe 83 PID 4268 wrote to memory of 3680 4268 cmd.exe 83 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "windows defender firewall" /tr '"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:4792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6F83.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3616
-
-
C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"C:\Users\Admin\AppData\Roaming\windows defender firewall.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169B
MD508850b23525344d3e506e51def699e9a
SHA1325026625e50b56554dea30a3196b9cfe5901d7e
SHA2569f8151bba8ed13b5dd275bb371dc6ffda22e411a5d1123cbe3b0a6efe2dfef02
SHA512288fb8af982c9ec4d14e9cfb054462602b12b105e12f7b58faaa1329bb3b63b57cbff766eeac9e4ed3b0fd9a3a4ca141da0955aad5320d3f8975ed93d4ada7bd
-
Filesize
63KB
MD54ae421ab5dc26aad7211a5bcc6ae89f2
SHA190f1c09a58087d15688db7bf63ae889d8b453751
SHA256884eacb6f51be1e6eba1296aece06baccd3f600f258494fef2dfcc34fd257ccd
SHA5120b9689d6718749b03a38d3f681cb62f70eb96438a24ad0ca0177ffa53c70bebe8bc3e28ef46df5165baaf11a876df3fe27f5ece785f748ac2b467d79a51eb1c2