Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
0s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 10:00
Static task
static1
General
-
Target
adswqadasw.exe
-
Size
2.9MB
-
MD5
c88eb41aa02785f785337117bce52dc9
-
SHA1
ee63f44027e89481fdb281b4e30fc6c8832679a2
-
SHA256
dd5c4d0eaa73513523864ff9a264f090153a5d38e425ec4d041173ef9ab1ab76
-
SHA512
67bedd5b7e052469ff29e6c9f6ddfd3c5a855612f769343a1a694baa53fb8c526518d00713720f94f320741d57121687b75b81999ddd065f8c712cc7c116328c
-
SSDEEP
24576:xQBAe4kTT+2YHQyODScZoml6mm/ri5R1PqA49GAxw4DRgGoGTBytyCCBdxF9Cqz+:xOAe4kX+fDxi5R1C10QgGeyxB7JCB
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
lfrlrahocljxyqyr
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/xFvrV0SD
Signatures
-
Asyncrat family
-
Executes dropped EXE 1 IoCs
pid Process 3036 winlogon.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2300 set thread context of 3036 2300 adswqadasw.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adswqadasw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 3036 2300 adswqadasw.exe 30 PID 2300 wrote to memory of 2916 2300 adswqadasw.exe 31 PID 2300 wrote to memory of 2916 2300 adswqadasw.exe 31 PID 2300 wrote to memory of 2916 2300 adswqadasw.exe 31 PID 2300 wrote to memory of 2916 2300 adswqadasw.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\adswqadasw.exe"C:\Users\Admin\AppData\Local\Temp\adswqadasw.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\winlogon.exeC:\winlogon.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54428c969f83fe0fb6bb2a635fe605bce
SHA115efa531bc399c5e92d72cf266f8e18b4ec78bb0
SHA256458b17876c0ea9ce182b9966f97d7617600ac6cb95c363cc7f33aec420424151
SHA5124896c3e06391a7caca83ae36fd2a093af81ad6165979ed23232fb35a4d85a7188ecbbc66e720c4cd3d86e4c5546848ce7b02e5d8e28cd02ca0c246b091e9d809