Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2025, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
2024.12.31止尾款结算对账核对表xlsx.exe
Resource
win7-20240903-en
General
-
Target
2024.12.31止尾款结算对账核对表xlsx.exe
-
Size
1.0MB
-
MD5
33961801df7df4040fb2282d6103286c
-
SHA1
1c0b29fa3a333974788a71c896e30f38e2bf3769
-
SHA256
782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a
-
SHA512
0d7a73ff1312de597fc71d3d5d0dda34e326ad2268a762695487547361a734568f21f1d0856dd9a502b704a9d5caa7ebc547baa329dc0f906ec003ca23dbd44a
-
SSDEEP
24576:CMjhKbkkc7tiPbWJF9WUqMFWsRvtciqgQRgOD39wKX:RI4kOtiTQWU4SciuRgC9T
Malware Config
Extracted
asyncrat
v1.2.2
Default
27.124.6.137:13651
oayguxqwqnan
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1216-65-0x00000000039D0000-0x00000000039E2000-memory.dmp family_asyncrat -
Executes dropped EXE 2 IoCs
pid Process 2600 2024.12.31止尾款结算对账核对表xlsx.tmp 732 2024.12.31止尾款结算对账核对表xlsx.tmp -
Loads dropped DLL 4 IoCs
pid Process 4688 regsvr32.exe 1216 regsvr32.exe 5096 regsvr32.EXE 2656 regsvr32.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to execute payload.
pid Process 8 powershell.exe 240 powershell.exe 4312 powershell.exe 3572 powershell.exe 240 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4532 timeout.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 732 2024.12.31止尾款结算对账核对表xlsx.tmp 732 2024.12.31止尾款结算对账核对表xlsx.tmp 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 8 powershell.exe 8 powershell.exe 240 powershell.exe 240 powershell.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 1216 regsvr32.exe 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 4312 powershell.exe 4312 powershell.exe 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 5096 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 3572 powershell.exe 3572 powershell.exe 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE 2656 regsvr32.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 8 powershell.exe Token: SeIncreaseQuotaPrivilege 8 powershell.exe Token: SeSecurityPrivilege 8 powershell.exe Token: SeTakeOwnershipPrivilege 8 powershell.exe Token: SeLoadDriverPrivilege 8 powershell.exe Token: SeSystemProfilePrivilege 8 powershell.exe Token: SeSystemtimePrivilege 8 powershell.exe Token: SeProfSingleProcessPrivilege 8 powershell.exe Token: SeIncBasePriorityPrivilege 8 powershell.exe Token: SeCreatePagefilePrivilege 8 powershell.exe Token: SeBackupPrivilege 8 powershell.exe Token: SeRestorePrivilege 8 powershell.exe Token: SeShutdownPrivilege 8 powershell.exe Token: SeDebugPrivilege 8 powershell.exe Token: SeSystemEnvironmentPrivilege 8 powershell.exe Token: SeRemoteShutdownPrivilege 8 powershell.exe Token: SeUndockPrivilege 8 powershell.exe Token: SeManageVolumePrivilege 8 powershell.exe Token: 33 8 powershell.exe Token: 34 8 powershell.exe Token: 35 8 powershell.exe Token: 36 8 powershell.exe Token: SeDebugPrivilege 240 powershell.exe Token: SeIncreaseQuotaPrivilege 240 powershell.exe Token: SeSecurityPrivilege 240 powershell.exe Token: SeTakeOwnershipPrivilege 240 powershell.exe Token: SeLoadDriverPrivilege 240 powershell.exe Token: SeSystemProfilePrivilege 240 powershell.exe Token: SeSystemtimePrivilege 240 powershell.exe Token: SeProfSingleProcessPrivilege 240 powershell.exe Token: SeIncBasePriorityPrivilege 240 powershell.exe Token: SeCreatePagefilePrivilege 240 powershell.exe Token: SeBackupPrivilege 240 powershell.exe Token: SeRestorePrivilege 240 powershell.exe Token: SeShutdownPrivilege 240 powershell.exe Token: SeDebugPrivilege 240 powershell.exe Token: SeSystemEnvironmentPrivilege 240 powershell.exe Token: SeRemoteShutdownPrivilege 240 powershell.exe Token: SeUndockPrivilege 240 powershell.exe Token: SeManageVolumePrivilege 240 powershell.exe Token: 33 240 powershell.exe Token: 34 240 powershell.exe Token: 35 240 powershell.exe Token: 36 240 powershell.exe Token: SeIncreaseQuotaPrivilege 240 powershell.exe Token: SeSecurityPrivilege 240 powershell.exe Token: SeTakeOwnershipPrivilege 240 powershell.exe Token: SeLoadDriverPrivilege 240 powershell.exe Token: SeSystemProfilePrivilege 240 powershell.exe Token: SeSystemtimePrivilege 240 powershell.exe Token: SeProfSingleProcessPrivilege 240 powershell.exe Token: SeIncBasePriorityPrivilege 240 powershell.exe Token: SeCreatePagefilePrivilege 240 powershell.exe Token: SeBackupPrivilege 240 powershell.exe Token: SeRestorePrivilege 240 powershell.exe Token: SeShutdownPrivilege 240 powershell.exe Token: SeDebugPrivilege 240 powershell.exe Token: SeSystemEnvironmentPrivilege 240 powershell.exe Token: SeRemoteShutdownPrivilege 240 powershell.exe Token: SeUndockPrivilege 240 powershell.exe Token: SeManageVolumePrivilege 240 powershell.exe Token: 33 240 powershell.exe Token: 34 240 powershell.exe Token: 35 240 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 732 2024.12.31止尾款结算对账核对表xlsx.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1216 regsvr32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3940 wrote to memory of 2600 3940 2024.12.31止尾款结算对账核对表xlsx.exe 82 PID 3940 wrote to memory of 2600 3940 2024.12.31止尾款结算对账核对表xlsx.exe 82 PID 3940 wrote to memory of 2600 3940 2024.12.31止尾款结算对账核对表xlsx.exe 82 PID 2600 wrote to memory of 2644 2600 2024.12.31止尾款结算对账核对表xlsx.tmp 83 PID 2600 wrote to memory of 2644 2600 2024.12.31止尾款结算对账核对表xlsx.tmp 83 PID 2600 wrote to memory of 2644 2600 2024.12.31止尾款结算对账核对表xlsx.tmp 83 PID 2644 wrote to memory of 4532 2644 cmd.exe 85 PID 2644 wrote to memory of 4532 2644 cmd.exe 85 PID 2644 wrote to memory of 4532 2644 cmd.exe 85 PID 2644 wrote to memory of 212 2644 cmd.exe 86 PID 2644 wrote to memory of 212 2644 cmd.exe 86 PID 2644 wrote to memory of 212 2644 cmd.exe 86 PID 212 wrote to memory of 732 212 2024.12.31止尾款结算对账核对表xlsx.exe 87 PID 212 wrote to memory of 732 212 2024.12.31止尾款结算对账核对表xlsx.exe 87 PID 212 wrote to memory of 732 212 2024.12.31止尾款结算对账核对表xlsx.exe 87 PID 732 wrote to memory of 4688 732 2024.12.31止尾款结算对账核对表xlsx.tmp 88 PID 732 wrote to memory of 4688 732 2024.12.31止尾款结算对账核对表xlsx.tmp 88 PID 732 wrote to memory of 4688 732 2024.12.31止尾款结算对账核对表xlsx.tmp 88 PID 4688 wrote to memory of 1216 4688 regsvr32.exe 89 PID 4688 wrote to memory of 1216 4688 regsvr32.exe 89 PID 1216 wrote to memory of 8 1216 regsvr32.exe 90 PID 1216 wrote to memory of 8 1216 regsvr32.exe 90 PID 1216 wrote to memory of 240 1216 regsvr32.exe 93 PID 1216 wrote to memory of 240 1216 regsvr32.exe 93 PID 5096 wrote to memory of 4312 5096 regsvr32.EXE 104 PID 5096 wrote to memory of 4312 5096 regsvr32.EXE 104 PID 2656 wrote to memory of 3572 2656 regsvr32.EXE 107 PID 2656 wrote to memory of 3572 2656 regsvr32.EXE 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\is-5LS2P.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp"C:\Users\Admin\AppData\Local\Temp\is-5LS2P.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$502C8,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\is-TFFHI.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp"C:\Users\Admin\AppData\Local\Temp\is-TFFHI.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$60270,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\system32\regsvr32.exe/s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"7⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat' }) { exit 0 } else { exit 1 }"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{65CD0C1C-0303-4ECF-A082-C0505BDD76C2}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240
-
-
-
-
-
-
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4312
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD5a4041ced69ac0cddcff4b3bd4f83b8d6
SHA1096dd280578200957d143f8d7963acae3b8819d4
SHA256a4bd8860c45b7fffa71e7a1aa43072b8c10f318f8cbc53e963602a3bfd777823
SHA51243f57a4381713c9401bbbba554979c895cbc55825d5fb3fa7b2c3a7700b809444b8d9eb26db474855ae8037fb0be24d1de51e86c81e18268593d8610a6621c0a
-
Filesize
1KB
MD512c844ed8342738dacc6eb0072c43257
SHA1b7f2f9e3ec4aaf5e2996720f129cd64887ac91d7
SHA2562afeb7db4e46d3c1524512a73448e9cd0121deec761d8aa54fa9fe8b56df7519
SHA512e3de9103533a69cccc36cd377297ba3ec9bd7a1159e1349d2cc01ab66a88a5a82b4ee3af61fab586a0cdfab915c7408735439fd0462c5c2cc2c787cb0765766a
-
Filesize
1KB
MD52cacea4e19ddf5755e70346cc1cbe27b
SHA1d4f7c2950f951857da18cfec490370152983e121
SHA2565488c6f47e2e55addf07b920f0ce43ed970515193c4cb1ffb845a9b441bcd9ad
SHA512445497cefd12a10e19272b51028a6b19d039b578a2e4d1f4c7f4c4bed447c55b1cd23453e9bed9307aaeb7b57ea8c721d1884eaaafa422df4607cfe3a75f54f7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.2MB
MD575c6fbc94f75010aebb8c0c11a646fcc
SHA100de6a9f9b02ac9e24db302fc705420740ca9029
SHA256ba9099f858da9b41bae8a46ca4b8a61b099a18cdbf43bcd3a2c31c0b8e30bede
SHA512e7f8d81d430258a3ddb07e2798cceb2a8cdd2e3150cdce8e88b745dfdf14f3491076212256a7d3c1b43217c47dd182c9822b4e9da34dbcf7760cbf05d525602b
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.4MB
MD5f7af43ee4b917ecc5051c5cb3a0ffe5c
SHA1786c74765b5121ab1fa431fc02d8dfd54eae9458
SHA256a43e88349c0757c3f122657e6696becde5316f9c31764eaee04e722a87f4b15b
SHA5126d7872e536e1c4aad3dc06f3d244c2f40bfe2dda417c7555b2387b98fe9bab88654db05ba9dfeadd29959cf9c44a16205e6a95d3465fbda77e6c95344a09b5b7