Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 05:56
Behavioral task
behavioral1
Sample
f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe
Resource
win7-20241010-en
General
-
Target
f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe
-
Size
63KB
-
MD5
6ae8830520e0bf079fc97aa207673ac6
-
SHA1
8eab31bfba85b5847573bda4257f79c607f0c297
-
SHA256
f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c
-
SHA512
cb8e918f34780d91673fdcc6bf3a70d2a1bf82bafb62f59ab6fc0f98b5ee09a8ed404d99fee25a4d5f55f9b7c4a5dc280d41725c596e6ddb8fae158542f14596
-
SSDEEP
1536:+62ZBUFWbPZEYUbeM9odcrXuEdpqKmY7:+62CWbP6YUbe1cr5Gz
Malware Config
Extracted
asyncrat
Default
127.0.0.1:1337
127.0.0.1:26550
147.185.221.24:1337
147.185.221.24:26550
-
delay
3
-
install
true
-
install_file
hawktuah.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b57-10.dat family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe -
Executes dropped EXE 1 IoCs
pid Process 4932 hawktuah.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2856 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3768 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe 4932 hawktuah.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe Token: SeDebugPrivilege 4932 hawktuah.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1472 wrote to memory of 4172 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 83 PID 1472 wrote to memory of 4172 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 83 PID 1472 wrote to memory of 3432 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 85 PID 1472 wrote to memory of 3432 1472 f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe 85 PID 4172 wrote to memory of 3768 4172 cmd.exe 87 PID 4172 wrote to memory of 3768 4172 cmd.exe 87 PID 3432 wrote to memory of 2856 3432 cmd.exe 88 PID 3432 wrote to memory of 2856 3432 cmd.exe 88 PID 3432 wrote to memory of 4932 3432 cmd.exe 89 PID 3432 wrote to memory of 4932 3432 cmd.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe"C:\Users\Admin\AppData\Local\Temp\f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "hawktuah" /tr '"C:\Users\Admin\AppData\Roaming\hawktuah.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "hawktuah" /tr '"C:\Users\Admin\AppData\Roaming\hawktuah.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:3768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp978D.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2856
-
-
C:\Users\Admin\AppData\Roaming\hawktuah.exe"C:\Users\Admin\AppData\Roaming\hawktuah.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5343eeb327862b6292c5febbcf9d67ffe
SHA110bb5e037be6bed35592cb505bd29ce451508246
SHA25685e32519d5f1df6bd790e339a46887cdeffc77453f866dfd62cceea3fcf7d924
SHA5124e45b83f6bb3b26644dcae3b3a30860dd6bd0fdc2ac606f18596e4e8fb819ad7586e67007b11ccab4060f4b0b428a5e0cfa9ef75bf05b629f16e3731aae86693
-
Filesize
63KB
MD56ae8830520e0bf079fc97aa207673ac6
SHA18eab31bfba85b5847573bda4257f79c607f0c297
SHA256f368400a4f67b6f2390343181e5d1945967c6cd25088798984e6e4654a1b928c
SHA512cb8e918f34780d91673fdcc6bf3a70d2a1bf82bafb62f59ab6fc0f98b5ee09a8ed404d99fee25a4d5f55f9b7c4a5dc280d41725c596e6ddb8fae158542f14596