Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/12/2024, 16:58
General
-
Target
hawk tuah.exe
-
Size
74KB
-
MD5
663e509c502abcc24092c39d32feb603
-
SHA1
1dcaca7cff53480cb2801c8d229dfda512af0e07
-
SHA256
72272ce432f2a7faa229466c11be9723164e09b3b4ac0309ccd2ee3ae0e59ea1
-
SHA512
3ee65b1e43c2164e46535a127dccefd163cd783d5f94147fa6b42d15b52f22ba73097f121cd4108837e7ce66438ee3164faee059f019c84dc955e36dab4668d0
-
SSDEEP
1536:rUEkcx4VHsC0SPMV39e4QKI3H1bLu3fwsQzcCLVclN:rUxcx4GfSPMVteTLH1bLcQTBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
147.185.221.24:30847
Mutex
toaaqdyqffdkpsux
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3836 hawk tuah.exe Token: SeIncreaseQuotaPrivilege 3836 hawk tuah.exe Token: SeSecurityPrivilege 3836 hawk tuah.exe Token: SeTakeOwnershipPrivilege 3836 hawk tuah.exe Token: SeLoadDriverPrivilege 3836 hawk tuah.exe Token: SeSystemProfilePrivilege 3836 hawk tuah.exe Token: SeSystemtimePrivilege 3836 hawk tuah.exe Token: SeProfSingleProcessPrivilege 3836 hawk tuah.exe Token: SeIncBasePriorityPrivilege 3836 hawk tuah.exe Token: SeCreatePagefilePrivilege 3836 hawk tuah.exe Token: SeBackupPrivilege 3836 hawk tuah.exe Token: SeRestorePrivilege 3836 hawk tuah.exe Token: SeShutdownPrivilege 3836 hawk tuah.exe Token: SeDebugPrivilege 3836 hawk tuah.exe Token: SeSystemEnvironmentPrivilege 3836 hawk tuah.exe Token: SeRemoteShutdownPrivilege 3836 hawk tuah.exe Token: SeUndockPrivilege 3836 hawk tuah.exe Token: SeManageVolumePrivilege 3836 hawk tuah.exe Token: 33 3836 hawk tuah.exe Token: 34 3836 hawk tuah.exe Token: 35 3836 hawk tuah.exe Token: 36 3836 hawk tuah.exe Token: SeIncreaseQuotaPrivilege 3836 hawk tuah.exe Token: SeSecurityPrivilege 3836 hawk tuah.exe Token: SeTakeOwnershipPrivilege 3836 hawk tuah.exe Token: SeLoadDriverPrivilege 3836 hawk tuah.exe Token: SeSystemProfilePrivilege 3836 hawk tuah.exe Token: SeSystemtimePrivilege 3836 hawk tuah.exe Token: SeProfSingleProcessPrivilege 3836 hawk tuah.exe Token: SeIncBasePriorityPrivilege 3836 hawk tuah.exe Token: SeCreatePagefilePrivilege 3836 hawk tuah.exe Token: SeBackupPrivilege 3836 hawk tuah.exe Token: SeRestorePrivilege 3836 hawk tuah.exe Token: SeShutdownPrivilege 3836 hawk tuah.exe Token: SeDebugPrivilege 3836 hawk tuah.exe Token: SeSystemEnvironmentPrivilege 3836 hawk tuah.exe Token: SeRemoteShutdownPrivilege 3836 hawk tuah.exe Token: SeUndockPrivilege 3836 hawk tuah.exe Token: SeManageVolumePrivilege 3836 hawk tuah.exe Token: 33 3836 hawk tuah.exe Token: 34 3836 hawk tuah.exe Token: 35 3836 hawk tuah.exe Token: 36 3836 hawk tuah.exe