Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 15:53
Static task
static1
Behavioral task
behavioral1
Sample
e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe
Resource
win10v2004-20241007-en
General
-
Target
e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe
-
Size
270KB
-
MD5
097fb93775b8349a0aa7de58e1a14c70
-
SHA1
40540069a8bb04a64107b1c34f0293d774d3f129
-
SHA256
e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161
-
SHA512
737f0b29eed3cafec815232a60f35c71ec2d8ad1347e4d2cb5741357157d8e45c2477a7ad7ac7829fd595b7c5de2da1f804c9402b73738a03a85859aef69a072
-
SSDEEP
3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdkXf:WFzDqa86hV6uRRqX1evPlwAEdkXf
Malware Config
Extracted
asyncrat
0.4.9G
corporation.warzonedns.com:9341
480-28105c055659
-
delay
0
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Contains code to disable Windows Defender 5 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/2900-36-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2900-35-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2900-34-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2900-31-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def behavioral1/memory/2900-29-0x0000000000400000-0x0000000000430000-memory.dmp disable_win_def -
Executes dropped EXE 1 IoCs
pid Process 2968 HiPatchService.exe -
Loads dropped DLL 1 IoCs
pid Process 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\HiPatch = "C:\\Users\\Admin\\AppData\\Roaming\\HiPatch\\HiPatchService.exe" e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2968 set thread context of 2900 2968 HiPatchService.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HiPatchService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe 2900 RegAsm.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2968 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 31 PID 2428 wrote to memory of 2968 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 31 PID 2428 wrote to memory of 2968 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 31 PID 2428 wrote to memory of 2968 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 31 PID 2428 wrote to memory of 2968 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 31 PID 2428 wrote to memory of 2968 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 31 PID 2428 wrote to memory of 2968 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 31 PID 2428 wrote to memory of 2724 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 32 PID 2428 wrote to memory of 2724 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 32 PID 2428 wrote to memory of 2724 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 32 PID 2428 wrote to memory of 2724 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 32 PID 2428 wrote to memory of 2724 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 32 PID 2428 wrote to memory of 2724 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 32 PID 2428 wrote to memory of 2724 2428 e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe 32 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34 PID 2968 wrote to memory of 2900 2968 HiPatchService.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe"C:\Users\Admin\AppData\Local\Temp\e7d8792a01226318a6d51f5de16b6f32a51ecb9e3726a665c007171a6dd09161N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2900
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\HiPatch\HiPatchService.bat""2⤵
- System Location Discovery: System Language Discovery
PID:2724
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD50955cb4b691d44b37f8b6fad48a33b8e
SHA19dae759ae014cc124ab6eed7c8035788c124ae4a
SHA2569092dbb1ca1767d1966b7f79349dd95a802a68248251bf070c0f1d74d5681d71
SHA51208b868a028c1e8d29ed643416850df16f58d44668f9193b46bd3934965e5617a0a4015fc52815c5456023dbde01023450d295b76d936a936f26b602e764b0235
-
Filesize
270KB
MD50373993f27dd5cfd68ed29fda8d542df
SHA18fdbccd1a487f254fe581cef0e38e54670a69d5b
SHA25697482443cb1c53feb152e1292663deb5ce477488e7e350d13258f77de2ecbad7
SHA51296f0d57bb01d9faed465007a33963df626411bbde873123c9e7abc83bdf20cc8fa1da9dd439a84d799d942bf62b7f99f3f31def4bb914a50ca35829a510f8690