Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26/12/2024, 22:25
General
-
Target
2.3.3.exe
-
Size
1.7MB
-
MD5
6eb122e96a700bd2b8cc99145e341dca
-
SHA1
cb7b638457cc0c9d91f2d160cff668be728e98e7
-
SHA256
7fdd01a97937e772442349582da60906c7af11674de1d2e7b5d8ef735d541310
-
SHA512
a58e58533c58adc4e247d7a8e9f96034e04083b58d24b4f31ce191722978a2544d620e44d54ede8956698267dda2466303085d2f4b013859d928e915551d73e4
-
SSDEEP
24576:m9ohkx17Y1hjhLYgHZ/3n9xNGEDx6sjoduqJaa+WB0cmukAoArSnw4GTNL2aa3/K:2skxe1/vNG2jSuryBJoeSnw4uO
Malware Config
Extracted
asyncrat
0.5.8
ahk
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
ZCYbbgUqVRxZ
-
delay
3
-
install
false
-
install_file
powerhouse.exe
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.3.3.exe"C:\Users\Admin\AppData\Local\Temp\2.3.3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
408KB
-
Filesize
624KB
-
Filesize
4.3MB