Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 01:56
General
-
Target
2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe
-
Size
4.6MB
-
MD5
dbafcba849e3702adefa9552bae860f4
-
SHA1
175e356348d0645ee461f4069812ba736cd1edeb
-
SHA256
0fc6c03f42ecb88fcfc3ea2973ee39c2f361fbec70c0085eb5892476b7210504
-
SHA512
3dc7c7d9e90bc1f34a4203cf0da7fa6e1223323bbf55054bb57fa5510a21507e5488a9e2ee5ba6058ccb7d9c33ec3fabb9245d02a41561619b1d9a6da268b7e0
-
SSDEEP
49152:hP7FEYi0KG0ZzpyZ9vAaE5FKY/t76oUz70g/YOKyjrbsnnzvS/9rMXB/GZPj1zn3:B5E/VVyZpoUzh/LsnzhmdXOY
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn HSzoORFply /tr C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HSzoORFply /tr C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exeC:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery