Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2024, 03:57 UTC

General

  • Target

    XOCYAkm_NnnfPmgVDNgu9MQ3.exe

  • Size

    5.3MB

  • MD5

    083da7bfea93dcaac5ca4c910c0c9636

  • SHA1

    5d94f9e397441ee8bb733122f9dce827b80f7e96

  • SHA256

    c06817143741717add66241dcd4f1b6ce497c6242d78793a69661b47a3796535

  • SHA512

    067b5940f3c04bbe908e978b735818cc6e46f8a34a6dfffdf63eca062b855d19a83f12e351dcb5da81464981771bb2a717d39bed9abdd96087cf4cd2996b31b5

  • SSDEEP

    98304:rHiCdkni6JIK0qZS3HzXCbQbxv3j+oJRfchpT93kWJrnClc3DgIFakHDZ++:OO4N0q4zXqC1TVsZ3bOlczgIND4+

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    "C:\Users\Admin\AppData\Local\Temp\XOCYAkm_NnnfPmgVDNgu9MQ3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2644

Network

    No results found
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    152 B
    3
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    152 B
    3
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    152 B
    3
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    152 B
    3
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    152 B
    3
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    152 B
    3
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
    152 B
    3
  • 185.232.169.198:54681
    XOCYAkm_NnnfPmgVDNgu9MQ3.exe
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2644-0-0x0000000001090000-0x0000000001DC2000-memory.dmp

    Filesize

    13.2MB

  • memory/2644-1-0x0000000076C41000-0x0000000076C42000-memory.dmp

    Filesize

    4KB

  • memory/2644-2-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-14-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-19-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-18-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-17-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-24-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-21-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-20-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-16-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-15-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-13-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-12-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-11-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-10-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-9-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-8-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-7-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-6-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-5-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-25-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-4-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-3-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-26-0x0000000001090000-0x0000000001DC2000-memory.dmp

    Filesize

    13.2MB

  • memory/2644-27-0x0000000001090000-0x0000000001DC2000-memory.dmp

    Filesize

    13.2MB

  • memory/2644-28-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

  • memory/2644-29-0x0000000001090000-0x0000000001DC2000-memory.dmp

    Filesize

    13.2MB

  • memory/2644-30-0x0000000076C41000-0x0000000076C42000-memory.dmp

    Filesize

    4KB

  • memory/2644-32-0x0000000076C30000-0x0000000076D40000-memory.dmp

    Filesize

    1.1MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.