Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 17:26

General

  • Target

    JaffaCakes118_a8e591ecd1aafcfa6e1a870be72987776f6fbce07e9e32d2a49a86b15d737b56.ps1

  • Size

    119KB

  • MD5

    a93b0ec43734f077d5d853fc60501180

  • SHA1

    2941fe0a75d42197faa8187bd349ef00a2f1fe11

  • SHA256

    a8e591ecd1aafcfa6e1a870be72987776f6fbce07e9e32d2a49a86b15d737b56

  • SHA512

    1ee7d11d6ea065ac944d9bd291d4398e04b5b36aacacbf890ad90323fcb753b650b95055744e7a6a06cd3c0a5be1634a259a536cae2b228c068b28961c4be492

  • SSDEEP

    1536:ae9x1r3st/0i/FXT676pe+wqota8YOnOQHuy+P3fkLG8VYk8Qk6fK:/r3stS0Lwqua8YJQd+P3fkdYkBK

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

daveblack.publicvm.com:3861

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a8e591ecd1aafcfa6e1a870be72987776f6fbce07e9e32d2a49a86b15d737b56.ps1
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d4cpsri0\d4cpsri0.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6B0.tmp" "c:\Users\Admin\AppData\Local\Temp\d4cpsri0\CSC8962EB54E85C43B59B6AF3E9119EED5.TMP"
        3⤵
          PID:2772
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:376

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESA6B0.tmp

      Filesize

      1KB

      MD5

      8e80fe18a2540ed5f13fba86a73e427e

      SHA1

      4aa859b0eb8daece38e8b67c7e9b1a8ed8763405

      SHA256

      0b9ff607d698240374ceeaf0bcbf58ecb1175db82a726b1b83224417a1082412

      SHA512

      3b989152e96155d842b51816cf1e25a4dbcb4a161b2157e60b07325f805ed93e5b6c76ecbe614297bcd726b51b8c42a1117a3bb4136d5fd38b59c633f5bca845

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j30f4z1x.gd0.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\d4cpsri0\d4cpsri0.dll

      Filesize

      11KB

      MD5

      285f937a02cac2879c4254bbecd25ecd

      SHA1

      1675177d6796ebd9ad9a3c186a1fc8a49f448b1f

      SHA256

      b5d3b06e0b55190701021f6964f2314538338843be4f4ff5c7abcd1015915488

      SHA512

      20a493eb4a33a62451b25b7037940a688294a3cda87c21fc95d1cd31497cb4d974427c535bc5a30f9ecfe9f00884ce0747d3aaf3b8872aacb2f419f4e27b7dd2

    • \??\c:\Users\Admin\AppData\Local\Temp\d4cpsri0\CSC8962EB54E85C43B59B6AF3E9119EED5.TMP

      Filesize

      652B

      MD5

      9ef49c6ef01bc03d159303ea53d92487

      SHA1

      68e61bb9088f934692ff248f61978879844833c3

      SHA256

      8439b2d4163f9a75b8abd936e8165ecd16109f49d8e6ceb2f859a15e9223b1de

      SHA512

      b95d03c7b72012b2dff9456e2f12a72e600ab207e38b70f87c39dadfa46b8df09350e3cef1157c3791a4dee599e3882b8381be1ffead7472e852d00c7f9aab7f

    • \??\c:\Users\Admin\AppData\Local\Temp\d4cpsri0\d4cpsri0.0.cs

      Filesize

      14KB

      MD5

      5b28648a4e188b0ebdf2d5edcda61624

      SHA1

      faf0ba6c2ef8d8184881eda8a276796449969e1c

      SHA256

      e92acafc5a9dd128b120809aaf76178275c3d22b13fb7cc2f0d9c624befed1b1

      SHA512

      972fca6205f8927363b751ff51c6cf07c3b42f7cbd8fbe12c1098df539118ecf3d3ce1af3b5d376c8710ed183786fc911279ff81941aba4202a11ca5670b9937

    • \??\c:\Users\Admin\AppData\Local\Temp\d4cpsri0\d4cpsri0.cmdline

      Filesize

      327B

      MD5

      2a6c5f27aa85f1bb610dd1f8fa8b90ec

      SHA1

      eacd16be85122703c4337f007677f0e9ded9555a

      SHA256

      5095d18cac297322bc6804f173fa904666feafb81a96f10ae5e114a6235f4c2a

      SHA512

      2d3bb3f001b5c459c089de34e87c23826828e636790d7f8d405d0268e1def850f025e32352961a3d34d9390e8ff3b4375dc1bc3af64a154c46a01c08e5248c31

    • memory/376-35-0x000000007480E000-0x000000007480F000-memory.dmp

      Filesize

      4KB

    • memory/376-34-0x000000007480E000-0x000000007480F000-memory.dmp

      Filesize

      4KB

    • memory/376-30-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1488-12-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-14-0x000001DCE9FD0000-0x000001DCEA4F8000-memory.dmp

      Filesize

      5.2MB

    • memory/1488-13-0x000001DCE9A20000-0x000001DCE9A96000-memory.dmp

      Filesize

      472KB

    • memory/1488-28-0x000001DCE7330000-0x000001DCE733A000-memory.dmp

      Filesize

      40KB

    • memory/1488-0-0x00007FF878A33000-0x00007FF878A35000-memory.dmp

      Filesize

      8KB

    • memory/1488-33-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-11-0x00007FF878A30000-0x00007FF8794F1000-memory.dmp

      Filesize

      10.8MB

    • memory/1488-10-0x000001DCE95C0000-0x000001DCE95E2000-memory.dmp

      Filesize

      136KB