Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2025, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
2024.12.31止尾款结算对账核对表xlsx.exe
Resource
win7-20240903-en
General
-
Target
2024.12.31止尾款结算对账核对表xlsx.exe
-
Size
1.0MB
-
MD5
33961801df7df4040fb2282d6103286c
-
SHA1
1c0b29fa3a333974788a71c896e30f38e2bf3769
-
SHA256
782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a
-
SHA512
0d7a73ff1312de597fc71d3d5d0dda34e326ad2268a762695487547361a734568f21f1d0856dd9a502b704a9d5caa7ebc547baa329dc0f906ec003ca23dbd44a
-
SSDEEP
24576:CMjhKbkkc7tiPbWJF9WUqMFWsRvtciqgQRgOD39wKX:RI4kOtiTQWU4SciuRgC9T
Malware Config
Extracted
asyncrat
v1.2.2
Default
27.124.6.137:13651
oayguxqwqnan
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4960-65-0x0000000003E30000-0x0000000003E42000-memory.dmp family_asyncrat -
Executes dropped EXE 2 IoCs
pid Process 2260 2024.12.31止尾款结算对账核对表xlsx.tmp 5040 2024.12.31止尾款结算对账核对表xlsx.tmp -
Loads dropped DLL 4 IoCs
pid Process 1152 regsvr32.exe 4960 regsvr32.exe 4424 regsvr32.EXE 2856 regsvr32.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to execute payload.
pid Process 548 powershell.exe 1292 powershell.exe 4188 powershell.exe 1800 powershell.exe 1292 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024.12.31止尾款结算对账核对表xlsx.tmp -
Delays execution with timeout.exe 1 IoCs
pid Process 4360 timeout.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 5040 2024.12.31止尾款结算对账核对表xlsx.tmp 5040 2024.12.31止尾款结算对账核对表xlsx.tmp 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 548 powershell.exe 548 powershell.exe 1292 powershell.exe 1292 powershell.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4960 regsvr32.exe 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 4188 powershell.exe 4188 powershell.exe 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 4424 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 1800 powershell.exe 1800 powershell.exe 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE 2856 regsvr32.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 548 powershell.exe Token: SeIncreaseQuotaPrivilege 548 powershell.exe Token: SeSecurityPrivilege 548 powershell.exe Token: SeTakeOwnershipPrivilege 548 powershell.exe Token: SeLoadDriverPrivilege 548 powershell.exe Token: SeSystemProfilePrivilege 548 powershell.exe Token: SeSystemtimePrivilege 548 powershell.exe Token: SeProfSingleProcessPrivilege 548 powershell.exe Token: SeIncBasePriorityPrivilege 548 powershell.exe Token: SeCreatePagefilePrivilege 548 powershell.exe Token: SeBackupPrivilege 548 powershell.exe Token: SeRestorePrivilege 548 powershell.exe Token: SeShutdownPrivilege 548 powershell.exe Token: SeDebugPrivilege 548 powershell.exe Token: SeSystemEnvironmentPrivilege 548 powershell.exe Token: SeRemoteShutdownPrivilege 548 powershell.exe Token: SeUndockPrivilege 548 powershell.exe Token: SeManageVolumePrivilege 548 powershell.exe Token: 33 548 powershell.exe Token: 34 548 powershell.exe Token: 35 548 powershell.exe Token: 36 548 powershell.exe Token: SeDebugPrivilege 1292 powershell.exe Token: SeIncreaseQuotaPrivilege 1292 powershell.exe Token: SeSecurityPrivilege 1292 powershell.exe Token: SeTakeOwnershipPrivilege 1292 powershell.exe Token: SeLoadDriverPrivilege 1292 powershell.exe Token: SeSystemProfilePrivilege 1292 powershell.exe Token: SeSystemtimePrivilege 1292 powershell.exe Token: SeProfSingleProcessPrivilege 1292 powershell.exe Token: SeIncBasePriorityPrivilege 1292 powershell.exe Token: SeCreatePagefilePrivilege 1292 powershell.exe Token: SeBackupPrivilege 1292 powershell.exe Token: SeRestorePrivilege 1292 powershell.exe Token: SeShutdownPrivilege 1292 powershell.exe Token: SeDebugPrivilege 1292 powershell.exe Token: SeSystemEnvironmentPrivilege 1292 powershell.exe Token: SeRemoteShutdownPrivilege 1292 powershell.exe Token: SeUndockPrivilege 1292 powershell.exe Token: SeManageVolumePrivilege 1292 powershell.exe Token: 33 1292 powershell.exe Token: 34 1292 powershell.exe Token: 35 1292 powershell.exe Token: 36 1292 powershell.exe Token: SeIncreaseQuotaPrivilege 1292 powershell.exe Token: SeSecurityPrivilege 1292 powershell.exe Token: SeTakeOwnershipPrivilege 1292 powershell.exe Token: SeLoadDriverPrivilege 1292 powershell.exe Token: SeSystemProfilePrivilege 1292 powershell.exe Token: SeSystemtimePrivilege 1292 powershell.exe Token: SeProfSingleProcessPrivilege 1292 powershell.exe Token: SeIncBasePriorityPrivilege 1292 powershell.exe Token: SeCreatePagefilePrivilege 1292 powershell.exe Token: SeBackupPrivilege 1292 powershell.exe Token: SeRestorePrivilege 1292 powershell.exe Token: SeShutdownPrivilege 1292 powershell.exe Token: SeDebugPrivilege 1292 powershell.exe Token: SeSystemEnvironmentPrivilege 1292 powershell.exe Token: SeRemoteShutdownPrivilege 1292 powershell.exe Token: SeUndockPrivilege 1292 powershell.exe Token: SeManageVolumePrivilege 1292 powershell.exe Token: 33 1292 powershell.exe Token: 34 1292 powershell.exe Token: 35 1292 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5040 2024.12.31止尾款结算对账核对表xlsx.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4960 regsvr32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4596 wrote to memory of 2260 4596 2024.12.31止尾款结算对账核对表xlsx.exe 82 PID 4596 wrote to memory of 2260 4596 2024.12.31止尾款结算对账核对表xlsx.exe 82 PID 4596 wrote to memory of 2260 4596 2024.12.31止尾款结算对账核对表xlsx.exe 82 PID 2260 wrote to memory of 3776 2260 2024.12.31止尾款结算对账核对表xlsx.tmp 83 PID 2260 wrote to memory of 3776 2260 2024.12.31止尾款结算对账核对表xlsx.tmp 83 PID 2260 wrote to memory of 3776 2260 2024.12.31止尾款结算对账核对表xlsx.tmp 83 PID 3776 wrote to memory of 4360 3776 cmd.exe 85 PID 3776 wrote to memory of 4360 3776 cmd.exe 85 PID 3776 wrote to memory of 4360 3776 cmd.exe 85 PID 3776 wrote to memory of 4004 3776 cmd.exe 86 PID 3776 wrote to memory of 4004 3776 cmd.exe 86 PID 3776 wrote to memory of 4004 3776 cmd.exe 86 PID 4004 wrote to memory of 5040 4004 2024.12.31止尾款结算对账核对表xlsx.exe 87 PID 4004 wrote to memory of 5040 4004 2024.12.31止尾款结算对账核对表xlsx.exe 87 PID 4004 wrote to memory of 5040 4004 2024.12.31止尾款结算对账核对表xlsx.exe 87 PID 5040 wrote to memory of 1152 5040 2024.12.31止尾款结算对账核对表xlsx.tmp 88 PID 5040 wrote to memory of 1152 5040 2024.12.31止尾款结算对账核对表xlsx.tmp 88 PID 5040 wrote to memory of 1152 5040 2024.12.31止尾款结算对账核对表xlsx.tmp 88 PID 1152 wrote to memory of 4960 1152 regsvr32.exe 89 PID 1152 wrote to memory of 4960 1152 regsvr32.exe 89 PID 4960 wrote to memory of 548 4960 regsvr32.exe 90 PID 4960 wrote to memory of 548 4960 regsvr32.exe 90 PID 4960 wrote to memory of 1292 4960 regsvr32.exe 93 PID 4960 wrote to memory of 1292 4960 regsvr32.exe 93 PID 4424 wrote to memory of 4188 4424 regsvr32.EXE 104 PID 4424 wrote to memory of 4188 4424 regsvr32.EXE 104 PID 2856 wrote to memory of 1800 2856 regsvr32.EXE 107 PID 2856 wrote to memory of 1800 2856 regsvr32.EXE 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\is-QTBBQ.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp"C:\Users\Admin\AppData\Local\Temp\is-QTBBQ.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$70068,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe"C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\is-I3PHB.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp"C:\Users\Admin\AppData\Local\Temp\is-I3PHB.tmp\2024.12.31止尾款结算对账核对表xlsx.tmp" /SL5="$401E4,702433,203776,C:\Users\Admin\AppData\Local\Temp\2024.12.31止尾款结算对账核对表xlsx.exe" /VERYSILENT /SUPPRESSMSGBOXES5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\regsvr32.exe/s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"7⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat' }) { exit 0 } else { exit 1 }"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{871ED1AB-4B6D-422E-AF60-FB3D3400BE81}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
-
-
-
-
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4188
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\Admin\AppData\Roaming\UptightChicken.dat' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5661739d384d9dfd807a089721202900b
SHA15b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA25670c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
SHA51281b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
-
Filesize
1KB
MD5614f488d003730bdaff6bcb7b3da867e
SHA116b163422c2db8103a827f5a7c741acb2a733bff
SHA2565c69272a78acdb95d5a955d5e2e2f4cbb4a8eddf73a2490a3a24db63f9a9a34d
SHA5129694319994014edede5595e4e2e9d105ac96273a112c9f38e3cfc9033dd77923ab3c6720f57272750a97870c458a1d96a91b4f7d4524995b2f8e744d6c5a8c1e
-
Filesize
1KB
MD571c4b1323b5c2b0b3dce79a418170c57
SHA1f2484755165cc812bd2017c3ff93d7aef8e9f642
SHA256b7151a59702581451ad3accb25d5aa7889a4d385142568331f42b0fcc2019872
SHA5129048311d8ca08c33c090038fce1b5f28d22e1b9b0c1a6bb27f97619c778e2d474a3f10ab92c76bd487b94e059b5d066d1d960eec15b6a3a74355099494172e51
-
Filesize
1KB
MD5fd0b92d1cbad27f095e806bbda0be6df
SHA1d3e5625a81eb97d670c82621b4da809742ef79cf
SHA25634ddfc4a298d2babd092d21a142907227c554afac208abe5cd769ab074b896f7
SHA512191adfa30ede171aee145bed2c4a8aa065360d6259e654c352ca77993a843b614539f64c6ee433f9b2e92364051f0968acfcfe1b3e797f51b9eea392734ee15c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.2MB
MD575c6fbc94f75010aebb8c0c11a646fcc
SHA100de6a9f9b02ac9e24db302fc705420740ca9029
SHA256ba9099f858da9b41bae8a46ca4b8a61b099a18cdbf43bcd3a2c31c0b8e30bede
SHA512e7f8d81d430258a3ddb07e2798cceb2a8cdd2e3150cdce8e88b745dfdf14f3491076212256a7d3c1b43217c47dd182c9822b4e9da34dbcf7760cbf05d525602b
-
Filesize
1.4MB
MD5f7af43ee4b917ecc5051c5cb3a0ffe5c
SHA1786c74765b5121ab1fa431fc02d8dfd54eae9458
SHA256a43e88349c0757c3f122657e6696becde5316f9c31764eaee04e722a87f4b15b
SHA5126d7872e536e1c4aad3dc06f3d244c2f40bfe2dda417c7555b2387b98fe9bab88654db05ba9dfeadd29959cf9c44a16205e6a95d3465fbda77e6c95344a09b5b7