Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 17:35
Behavioral task
behavioral1
Sample
Infected.exe
Resource
win7-20240903-en
General
-
Target
Infected.exe
-
Size
63KB
-
MD5
abcbbfd4f4cdcef98962ad976802fb69
-
SHA1
ecce5776a92707e00b28441975e73a715f9e2185
-
SHA256
1ee1af228d0cfcf2beae5a2df53a291d24fb6213c5e453cfb09c155b20a7a965
-
SHA512
e38348d3f6983e02378dd4649630fd0a39ad6428bc82aa6f2738f1ec794b9b48db7457b3009f7f65e49fc5d994dcde6105fdf72bd572086d8017558aab541100
-
SSDEEP
768:RdGnVhwdjndk78TQC8A+XiuazcBRL5JTk1+T4KSBGHmDbD/ph0oXQxa/qSuAdpqM:mnSdsNdSJYUbdh9QxaFuAdpqKmY7
Malware Config
Extracted
asyncrat
Default
mbaper-28496.portmap.host:2420
mbaper-28496.portmap.host:28833
-
delay
1
-
install
true
-
install_file
Google.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023cbd-11.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Infected.exe -
Executes dropped EXE 1 IoCs
pid Process 3196 Google.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1624 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4688 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe 4832 Infected.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4832 Infected.exe Token: SeDebugPrivilege 3196 Google.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4832 wrote to memory of 5044 4832 Infected.exe 85 PID 4832 wrote to memory of 5044 4832 Infected.exe 85 PID 4832 wrote to memory of 3604 4832 Infected.exe 86 PID 4832 wrote to memory of 3604 4832 Infected.exe 86 PID 3604 wrote to memory of 1624 3604 cmd.exe 89 PID 3604 wrote to memory of 1624 3604 cmd.exe 89 PID 5044 wrote to memory of 4688 5044 cmd.exe 90 PID 5044 wrote to memory of 4688 5044 cmd.exe 90 PID 3604 wrote to memory of 3196 3604 cmd.exe 92 PID 3604 wrote to memory of 3196 3604 cmd.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Infected.exe"C:\Users\Admin\AppData\Local\Temp\Infected.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Google" /tr '"C:\Users\Admin\AppData\Roaming\Google.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Google" /tr '"C:\Users\Admin\AppData\Roaming\Google.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:4688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAE80.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1624
-
-
C:\Users\Admin\AppData\Roaming\Google.exe"C:\Users\Admin\AppData\Roaming\Google.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD5a11e9f87931a580ad8c6b0ab3200ea26
SHA1bcade5ef5551904e74948820a570fd34c9324f72
SHA25648c99c83f103a46d5dfc7fefd33012485b35f454cb1024ce33fccfdec7454274
SHA5124ed8324288c71e9507f43e3d1812aea1eb00a6aad0278e75f2444abd3de0a50d13f269b8405845deca6d78825d1d1e28b899ee9c2e771f2aad3113ced29a43f1
-
Filesize
63KB
MD5abcbbfd4f4cdcef98962ad976802fb69
SHA1ecce5776a92707e00b28441975e73a715f9e2185
SHA2561ee1af228d0cfcf2beae5a2df53a291d24fb6213c5e453cfb09c155b20a7a965
SHA512e38348d3f6983e02378dd4649630fd0a39ad6428bc82aa6f2738f1ec794b9b48db7457b3009f7f65e49fc5d994dcde6105fdf72bd572086d8017558aab541100