Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2025, 23:48

General

  • Target

    16a8243c0de7fcee6a75f2f69794923d6887c0737fe774d9333ccb5be3ce492dN.exe

  • Size

    598KB

  • MD5

    82039919a6c42b252f711124bd7edaf0

  • SHA1

    699aa7d8614ee225dc3c10d18a0b38c95ffa2dd3

  • SHA256

    16a8243c0de7fcee6a75f2f69794923d6887c0737fe774d9333ccb5be3ce492d

  • SHA512

    9476f67d58a93bfd592c3a5b1aa1e16a689d0b0960749e46e7fcd3b2d3007ca7b92b7a99ea95f724e9aec1692cfc52ad1fd0ef4c875198723fc49ee481ca6d06

  • SSDEEP

    6144:MKWlw1DxD6ASIAfCEv2YUMNJlaJuNlK17Y4c83fhysVufBn597NX2F:M7lw1Dxe5zfXeYU43fiysgfBnnl2F

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • RevengeRat Executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16a8243c0de7fcee6a75f2f69794923d6887c0737fe774d9333ccb5be3ce492dN.exe
    "C:\Users\Admin\AppData\Local\Temp\16a8243c0de7fcee6a75f2f69794923d6887c0737fe774d9333ccb5be3ce492dN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe
      C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe -install -58118521 -chipde -215844c1b82f4b8abee4642ddd99f084 - -BLUB1 -ooqtagrkarfmtumh -459148
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OCS\ocs_v71a.exe

    Filesize

    288KB

    MD5

    317ec5f92cfbf04a53e8125b66b3b4af

    SHA1

    16068b8977b4dc562ae782d91bc009472667e331

    SHA256

    7612ef3877c3e4e305a6c22941141601b489a73bc088622a40ebd93bee25bae5

    SHA512

    ed772da641a5c128677c4c285c648c1d8e539c34522b95c14f614797bb0d188571c7c257441d45598809aa3f8b4690bd53230282726e077c86c8d9fe71c1db65

  • C:\Users\Admin\AppData\Local\Temp\OCS\ooqtagrkarfmtumh.dat

    Filesize

    81B

    MD5

    5d7b5b220ed191dec6c47849aef50a18

    SHA1

    27592a7ada90d9007517c297a8d5aba4e8ff0f22

    SHA256

    460b5268ad1e79c6785487c7ff4375441a4152174838e7b98fcfd4a8e8ec614b

    SHA512

    b30d627d6de0b16fa1d55ae0dbe3250931faa36e64ce9046459d2dda80a8ae4590b6fc5c97b322ddd7728bdb9fc1aa63c169421ff712fcc724bb10e6b0dd7138

  • memory/2056-12-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

    Filesize

    4KB

  • memory/2056-14-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-15-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-16-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-17-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-18-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-19-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-20-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-21-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB

  • memory/2056-22-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

    Filesize

    9.6MB