Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe
Resource
win7-20240903-en
General
-
Target
38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe
-
Size
694KB
-
MD5
32c67f99f3c95ba5e1816ca208f9b723
-
SHA1
c1e29ecea3c87d671448b9dbcc8d8c67b0d14b7e
-
SHA256
38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7
-
SHA512
578526bda2f08948475726f36bf247aabeb8f3941f95153d6786bc0db6e43bad44502ef1757bae2bb7c6f6bd0a4bd51e9b33ae363be293b75f490a26c03795f8
-
SSDEEP
12288:btoKggb2iNdvpc++pd1yIBbrk4ct0gdK/5SVns2M2TgN/0s:5oKgK1XpSpGIZn9+YSVsggi
Malware Config
Extracted
asyncrat
0.5.7B
Default
37.0.14.198:6161
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2676 powershell.exe 2796 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 1604 .exe 1492 .exe -
Loads dropped DLL 2 IoCs
pid Process 1248 cmd.exe 1604 .exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2324 set thread context of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 1604 set thread context of 1492 1604 .exe 48 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1672 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2052 schtasks.exe 2576 schtasks.exe 2472 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2676 powershell.exe 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 2796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeDebugPrivilege 1492 .exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2676 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 31 PID 2324 wrote to memory of 2676 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 31 PID 2324 wrote to memory of 2676 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 31 PID 2324 wrote to memory of 2676 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 31 PID 2324 wrote to memory of 2576 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 33 PID 2324 wrote to memory of 2576 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 33 PID 2324 wrote to memory of 2576 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 33 PID 2324 wrote to memory of 2576 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 33 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2324 wrote to memory of 2792 2324 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 35 PID 2792 wrote to memory of 484 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 36 PID 2792 wrote to memory of 484 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 36 PID 2792 wrote to memory of 484 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 36 PID 2792 wrote to memory of 484 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 36 PID 2792 wrote to memory of 1248 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 38 PID 2792 wrote to memory of 1248 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 38 PID 2792 wrote to memory of 1248 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 38 PID 2792 wrote to memory of 1248 2792 38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe 38 PID 484 wrote to memory of 2472 484 cmd.exe 40 PID 484 wrote to memory of 2472 484 cmd.exe 40 PID 484 wrote to memory of 2472 484 cmd.exe 40 PID 484 wrote to memory of 2472 484 cmd.exe 40 PID 1248 wrote to memory of 1672 1248 cmd.exe 41 PID 1248 wrote to memory of 1672 1248 cmd.exe 41 PID 1248 wrote to memory of 1672 1248 cmd.exe 41 PID 1248 wrote to memory of 1672 1248 cmd.exe 41 PID 1248 wrote to memory of 1604 1248 cmd.exe 42 PID 1248 wrote to memory of 1604 1248 cmd.exe 42 PID 1248 wrote to memory of 1604 1248 cmd.exe 42 PID 1248 wrote to memory of 1604 1248 cmd.exe 42 PID 1604 wrote to memory of 2796 1604 .exe 44 PID 1604 wrote to memory of 2796 1604 .exe 44 PID 1604 wrote to memory of 2796 1604 .exe 44 PID 1604 wrote to memory of 2796 1604 .exe 44 PID 1604 wrote to memory of 2052 1604 .exe 46 PID 1604 wrote to memory of 2052 1604 .exe 46 PID 1604 wrote to memory of 2052 1604 .exe 46 PID 1604 wrote to memory of 2052 1604 .exe 46 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48 PID 1604 wrote to memory of 1492 1604 .exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe"C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nxBIuIS.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nxBIuIS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp88CF.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe"C:\Users\Admin\AppData\Local\Temp\38e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "" /tr '"C:\Users\Admin\AppData\Roaming\.exe"' & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "" /tr '"C:\Users\Admin\AppData\Roaming\.exe"'4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2472
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp97AD.tmp.bat""3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1672
-
-
C:\Users\Admin\AppData\Roaming\.exe"C:\Users\Admin\AppData\Roaming\.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nxBIuIS.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nxBIuIS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp558F.tmp"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2052
-
-
C:\Users\Admin\AppData\Roaming\.exe"C:\Users\Admin\AppData\Roaming\.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54f90a7174bb34b400a64202a8c28ab57
SHA13d78ef9e7468afeb417af90f8aebed71e27669b8
SHA25628bff45b4da73c2901a2388c85e3447680cd6f6541f543f6b2f62be5b0ee03a3
SHA512b2466543740950bc2cb4ccc0194118ba8ea71bc26480fd32405de9bb1aeeb8d09196bd3c2eb5efabcf966cb634102087a892f580d5d9059142e0ace6f7830ea7
-
Filesize
144B
MD549c7432bf76bf15717378e926ef90989
SHA1280e34076f9ad4485674552a8ead54ed9b2719d1
SHA256d29608900b6494810b447c7a853cd89ba7a11dcf13853588b4f0ba20cd8a63fb
SHA5121c39eea4c73625389ef1161470d5d2c12b63611135a0e47cf916f2bbddc46b5dba17630e600c4a439318f9c28b38fa9ba09fe03d276ca574d2278fbaa507350e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VY5P8G29UN857R5HYKC2.temp
Filesize7KB
MD5ae52db759c9c845232948e3334b98364
SHA17b9526b9af163debb48d49cd2733dad282b903b3
SHA256032d14063c9a4efcd702b6998b86d6c34f2267294cbe5c8efccbedf9f2e9d914
SHA512deaac5507addce40033341dda9fb52ff75d4ae5483e2958dfa23cd30f402299d300c7c7e3033d895dfbba04856e2edce6c95ffe1558f90cd176c87eed015a80e
-
Filesize
694KB
MD532c67f99f3c95ba5e1816ca208f9b723
SHA1c1e29ecea3c87d671448b9dbcc8d8c67b0d14b7e
SHA25638e1bbae005365e92cf80aa6ef199d5107af57fde3afb02c31dc1bde875c68f7
SHA512578526bda2f08948475726f36bf247aabeb8f3941f95153d6786bc0db6e43bad44502ef1757bae2bb7c6f6bd0a4bd51e9b33ae363be293b75f490a26c03795f8