Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 04:41
Behavioral task
behavioral1
Sample
3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe
Resource
win7-20240903-en
General
-
Target
3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe
-
Size
74KB
-
MD5
b8ffca27af2dd7eaf924544d9f4dc080
-
SHA1
9cb5945789c67912ac20ab478bc0596b10db28a8
-
SHA256
3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9c
-
SHA512
a9f3f7bbce8d658c5a6a8489ddb4d694865074f29499ee8856cff3bdd87758761d03466ccd509c24c7f68c14907f70c866ee1bbaad9ed22e51e4d500b8a58a43
-
SSDEEP
1536:eUYNwcxKHXwzCtmPMV3JSaGLm43XHIls1bP/7jnQzcyLVclN:eUYicxK8WmPMV3wDn4s1bPTbQjBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:9999
ytgjjhywchk
-
delay
1
-
install
true
-
install_file
RealtekHighDefinitionAudio.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
resource yara_rule behavioral1/memory/2556-1-0x0000000001110000-0x0000000001128000-memory.dmp VenomRAT behavioral1/files/0x00090000000174a2-16.dat VenomRAT behavioral1/memory/2908-18-0x0000000000D00000-0x0000000000D18000-memory.dmp VenomRAT -
Venomrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x00090000000174a2-16.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2908 RealtekHighDefinitionAudio.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 832 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2728 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe 2908 RealtekHighDefinitionAudio.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe Token: SeDebugPrivilege 2908 RealtekHighDefinitionAudio.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2908 RealtekHighDefinitionAudio.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2348 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 31 PID 2556 wrote to memory of 2348 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 31 PID 2556 wrote to memory of 2348 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 31 PID 2556 wrote to memory of 1628 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 32 PID 2556 wrote to memory of 1628 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 32 PID 2556 wrote to memory of 1628 2556 3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe 32 PID 1628 wrote to memory of 832 1628 cmd.exe 35 PID 1628 wrote to memory of 832 1628 cmd.exe 35 PID 1628 wrote to memory of 832 1628 cmd.exe 35 PID 2348 wrote to memory of 2728 2348 cmd.exe 36 PID 2348 wrote to memory of 2728 2348 cmd.exe 36 PID 2348 wrote to memory of 2728 2348 cmd.exe 36 PID 1628 wrote to memory of 2908 1628 cmd.exe 37 PID 1628 wrote to memory of 2908 1628 cmd.exe 37 PID 1628 wrote to memory of 2908 1628 cmd.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe"C:\Users\Admin\AppData\Local\Temp\3ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9cN.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RealtekHighDefinitionAudio" /tr '"C:\Users\Admin\AppData\Roaming\RealtekHighDefinitionAudio.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RealtekHighDefinitionAudio" /tr '"C:\Users\Admin\AppData\Roaming\RealtekHighDefinitionAudio.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2728
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD5E5.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:832
-
-
C:\Users\Admin\AppData\Roaming\RealtekHighDefinitionAudio.exe"C:\Users\Admin\AppData\Roaming\RealtekHighDefinitionAudio.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
170B
MD5b120c8ad7b7fce10eed694077e0de301
SHA1e46dc76ff8b771cee7f9c7d373ea9ec8321eb08c
SHA2561acaf43334089b37cf3d9158550a84ce84134d56682b6df5f3a3743f7b9c426f
SHA51218d4aa7f9c1fdd27a30f63927b9dd937fa137942a101cee158bded127c165db739ddc81e2047b921c4fdc4333b88252ca4322db54290e2a5970e23d1491aef1e
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
74KB
MD5b8ffca27af2dd7eaf924544d9f4dc080
SHA19cb5945789c67912ac20ab478bc0596b10db28a8
SHA2563ea64a857060b493866007e05f14c9d55f33dfca30bf4b5e7082e2270d25ed9c
SHA512a9f3f7bbce8d658c5a6a8489ddb4d694865074f29499ee8856cff3bdd87758761d03466ccd509c24c7f68c14907f70c866ee1bbaad9ed22e51e4d500b8a58a43