Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/02/2025, 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
xm.ocx.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
xm.ocx.exe
-
Size
3.3MB
-
MD5
45ccb4f3c18ee9a044abd6117e32868d
-
SHA1
e34b03cb092ea7d139eaffe9bc84e9e83120db80
-
SHA256
b9b628725d830cb53c6854bd5bc5f6d6607cce3ec06821ec323fdb876f883d08
-
SHA512
566f157bf9f508ad6fae249f05fad74ea0ce4573e7cd67e4a68c6edf6d064783c14719a913b50d3bb1df5b719a1ee750aeb51cd91a238b71d4b7a24d9ebfca53
-
SSDEEP
98304:VlUOwdXxngJRzhTMU2dZvxO4V84DdDoolft0:V2hxngJRzhQZxx0
Malware Config
Signatures
-
Fatalrat family
-
Fatal Rat payload 1 IoCs
resource yara_rule behavioral1/memory/2120-2-0x0000000010000000-0x000000001002D000-memory.dmp fatalrat -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xm.ocx.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 xm.ocx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz xm.ocx.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe 2120 xm.ocx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2120 xm.ocx.exe