Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
351c0cfc753...0a.exe
windows7-x64
1051c0cfc753...0a.exe
windows10-2004-x64
1051c0cfc753...0a.exe
android-9-x86
51c0cfc753...0a.exe
android-10-x64
51c0cfc753...0a.exe
android-11-x64
51c0cfc753...0a.exe
macos-10.15-amd64
51c0cfc753...0a.exe
ubuntu-18.04-amd64
51c0cfc753...0a.exe
debian-9-armhf
51c0cfc753...0a.exe
debian-9-mips
51c0cfc753...0a.exe
debian-9-mipsel
Resubmissions
13/01/2025, 00:07
250113-aegj6awkdt 1012/01/2025, 09:31
250112-lg7d5syqdk 1012/01/2025, 06:04
250112-gs1zaazlax 10Analysis
-
max time kernel
891s -
max time network
893s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral4
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral5
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral6
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
macos-20241106-en
Behavioral task
behavioral7
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral8
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral9
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral10
Sample
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
Resource
debian9-mipsel-20240226-en
General
-
Target
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe
-
Size
1.3MB
-
MD5
4c71ccf76dccb2c58a85f67cf2fc6206
-
SHA1
42436168ecfa82313617b91cebf489a11e28f29a
-
SHA256
51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a
-
SHA512
24be3ac224544c2a38466604fb285155b1fddc811ee304ac5bfa46abadb925eba44d156c84f94a95b7e95cf28491405f748278ba287b531e24241a07a1cdc752
-
SSDEEP
24576:VMjhqBd3X3R+wTqM6FWEn72mHvKgcLJj3gSPWbLK3AtIT2Awyfc7MEYb6:MEBdH3dt6gmHdclj3IK3zT27yEbYe
Malware Config
Extracted
asyncrat
v1.2.2
Default
192.238.134.73:56003
192.238.134.73:56004
192.238.134.73:56005
vjggiafzsllukefmlx
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2888-67-0x0000000000220000-0x0000000000232000-memory.dmp family_asyncrat -
Executes dropped EXE 2 IoCs
pid Process 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp -
Loads dropped DLL 8 IoCs
pid Process 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 2816 regsvr32.exe 2888 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to execute payload.
pid Process 2152 powershell.exe 2704 powershell.exe 2152 powershell.exe 2704 powershell.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 2152 powershell.exe 2704 powershell.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe 2888 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2152 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeDebugPrivilege 2888 regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2888 regsvr32.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1796 wrote to memory of 2132 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 30 PID 1796 wrote to memory of 2132 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 30 PID 1796 wrote to memory of 2132 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 30 PID 1796 wrote to memory of 2132 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 30 PID 1796 wrote to memory of 2132 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 30 PID 1796 wrote to memory of 2132 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 30 PID 1796 wrote to memory of 2132 1796 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 30 PID 2132 wrote to memory of 2356 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 31 PID 2132 wrote to memory of 2356 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 31 PID 2132 wrote to memory of 2356 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 31 PID 2132 wrote to memory of 2356 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 31 PID 2132 wrote to memory of 2356 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 31 PID 2132 wrote to memory of 2356 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 31 PID 2132 wrote to memory of 2356 2132 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 31 PID 2356 wrote to memory of 1692 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 32 PID 2356 wrote to memory of 1692 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 32 PID 2356 wrote to memory of 1692 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 32 PID 2356 wrote to memory of 1692 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 32 PID 2356 wrote to memory of 1692 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 32 PID 2356 wrote to memory of 1692 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 32 PID 2356 wrote to memory of 1692 2356 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe 32 PID 1692 wrote to memory of 2816 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 33 PID 1692 wrote to memory of 2816 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 33 PID 1692 wrote to memory of 2816 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 33 PID 1692 wrote to memory of 2816 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 33 PID 1692 wrote to memory of 2816 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 33 PID 1692 wrote to memory of 2816 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 33 PID 1692 wrote to memory of 2816 1692 51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp 33 PID 2816 wrote to memory of 2888 2816 regsvr32.exe 34 PID 2816 wrote to memory of 2888 2816 regsvr32.exe 34 PID 2816 wrote to memory of 2888 2816 regsvr32.exe 34 PID 2816 wrote to memory of 2888 2816 regsvr32.exe 34 PID 2816 wrote to memory of 2888 2816 regsvr32.exe 34 PID 2816 wrote to memory of 2888 2816 regsvr32.exe 34 PID 2816 wrote to memory of 2888 2816 regsvr32.exe 34 PID 2888 wrote to memory of 2152 2888 regsvr32.exe 35 PID 2888 wrote to memory of 2152 2888 regsvr32.exe 35 PID 2888 wrote to memory of 2152 2888 regsvr32.exe 35 PID 2888 wrote to memory of 2704 2888 regsvr32.exe 37 PID 2888 wrote to memory of 2704 2888 regsvr32.exe 37 PID 2888 wrote to memory of 2704 2888 regsvr32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exeC:\Users\Admin\AppData\Local\Temp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe cmd /c %SIGILL% "SIGTERM|SIGKILL|SIGABRT"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\is-7IS9Q.tmp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp"C:\Users\Admin\AppData\Local\Temp\is-7IS9Q.tmp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp" /SL5="$40016,948933,235520,C:\Users\Admin\AppData\Local\Temp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe" cmd /c %SIGILL% "SIGTERM|SIGKILL|SIGABRT"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe"C:\Users\Admin\AppData\Local\Temp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe" /VERYSILENT3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\is-2FHNO.tmp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp"C:\Users\Admin\AppData\Local\Temp\is-2FHNO.tmp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp" /SL5="$50016,948933,235520,C:\Users\Admin\AppData\Local\Temp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:360 C:\Users\Admin\AppData\Roaming\Setup_Stork.dll5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\regsvr32.exe/s /i:360 C:\Users\Admin\AppData\Roaming\Setup_Stork.dll6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\Admin\AppData\Roaming\Setup_Stork.dll' }) { exit 0 } else { exit 1 }"7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:360 C:\Users\Admin\AppData\Roaming\Setup_Stork.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{C3C5CC22-17D3-4971-D2AD-6494EE73A876}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5c227294fdb020d200e996b36316a6f8e
SHA11374b79fff593130e0be1690c70c1960a5f499da
SHA256cdbfed1e9dc85df3e1b608bd3ba16ff15f32bba127409f596b43e0701ceaa19f
SHA512e8ae4b33db3bc2afcf4d93ba42f37f6c0bb52bbb9d4fd7758e6e3dc24d61b7310cb81858b0da705d8522cfaed53c02e4d23f1d20369795130977a41921c0d7f4
-
Filesize
2.6MB
MD5be749ce6cea9df27363dd3a47682344b
SHA1db9680d1fbaa852212a4693d37d64f412c30a1bc
SHA2568ae29824b1554e170133fe7fae8b9208526f1ab1b70a6299f5befcc0482db095
SHA5128f423ea8db31aaa723145ba94e00c2c2891ad361ee6e0dc5f8f2fd11f2e7cd72c387157e6d7c759eb9f8b9f227e317775ef71c283687fa8a58779ef70abbbf42
-
\Users\Admin\AppData\Local\Temp\is-7IS9Q.tmp\51c0cfc7539dc3bb883969d384a7389373a144f65ce6d1b5ec39bff2f616510a.tmp
Filesize1.2MB
MD5bef5bad133138ce27f0c6e73d5a2e5f9
SHA11cfc9e170e100fc23073cdfcf590594e18598314
SHA25655adc6677700e166913c9f26a213d93244242b17331b4f9a606760117b698b65
SHA512f8d3d971a58fdc2d7585c61c70c41d0625b2cbda9698f7a26ed009374d9f4986effc9d69dd1579f38f22bd7e7700d714702df663dfcc195c11b6fc2d0b315f2d
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3