Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 01:45
General
-
Target
2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe
-
Size
600.1MB
-
MD5
3d9729705bc8fe0e100c96d03b4891df
-
SHA1
9b59b630ac39de92c3ef592bdcde8b0703953b33
-
SHA256
626c3199d139fbd3b2d56e67ab5aa21a87c4796c14f2c434d5afd78b8c0adf73
-
SHA512
3c71480e02327cd2051a80690dfae22d7c3c83f543d2bd14874004d95373317e69d4a051bff35deaa881a6f959b144db0932330a7bee5afd7288d265a7ef0965
-
SSDEEP
12582912:RJVj5uX9Wx79hP0ALAEncYkTZ/ee4P87coh+rh+K3dq:EA5cYkTZ/kPpomh+sdq
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn HSzoORFply /tr C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HSzoORFply /tr C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exeC:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery