Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/03/2025, 08:24
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240729-en
General
-
Target
Client.exe
-
Size
74KB
-
MD5
a3b9079cb3f336a8e010a25d943e74a1
-
SHA1
0b0a82a0e91aa10d032f51c3aca80311a43e62e0
-
SHA256
e92ae266c9913cbf2c957fd3425e62443a4c75260ad7327d214129c404260d4e
-
SHA512
b6b23d7f71863c6bb753b256d6b3a053a9860ed09eb1b753faf8520376df54eadecc6f997baf0a4c4c2090274cae9ab751249d1306fece54408f8fcd099ddadc
-
SSDEEP
1536:cOUAQcxh31CfGPMVGe9VdQuDI6H1bf/UCZbzreQzcaLVclN:cOUlcxhlEGPMVGe9VdQsH1bfbV/eQLBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
127.0.0.1:4449
127.0.0.1:7771
127.0.0.1:35044
193.161.193.99:4449
193.161.193.99:7771
193.161.193.99:35044
samjkhqsigurr
-
delay
1
-
install
true
-
install_file
Microsoft Corporation INC..exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
resource yara_rule behavioral1/memory/2088-1-0x0000000001300000-0x0000000001318000-memory.dmp VenomRAT behavioral1/files/0x0031000000018bf3-16.dat VenomRAT behavioral1/memory/2776-18-0x0000000000C90000-0x0000000000CA8000-memory.dmp VenomRAT -
Venomrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0031000000018bf3-16.dat family_asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2776 Microsoft Corporation INC..exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 2580 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2844 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2088 Client.exe 2088 Client.exe 2088 Client.exe 2088 Client.exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe 2776 Microsoft Corporation INC..exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2088 Client.exe Token: SeDebugPrivilege 2088 Client.exe Token: SeDebugPrivilege 2776 Microsoft Corporation INC..exe Token: SeDebugPrivilege 2776 Microsoft Corporation INC..exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2776 Microsoft Corporation INC..exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2788 2088 Client.exe 30 PID 2088 wrote to memory of 2788 2088 Client.exe 30 PID 2088 wrote to memory of 2788 2088 Client.exe 30 PID 2088 wrote to memory of 2808 2088 Client.exe 31 PID 2088 wrote to memory of 2808 2088 Client.exe 31 PID 2088 wrote to memory of 2808 2088 Client.exe 31 PID 2788 wrote to memory of 2844 2788 cmd.exe 34 PID 2788 wrote to memory of 2844 2788 cmd.exe 34 PID 2788 wrote to memory of 2844 2788 cmd.exe 34 PID 2808 wrote to memory of 2580 2808 cmd.exe 35 PID 2808 wrote to memory of 2580 2808 cmd.exe 35 PID 2808 wrote to memory of 2580 2808 cmd.exe 35 PID 2808 wrote to memory of 2776 2808 cmd.exe 36 PID 2808 wrote to memory of 2776 2808 cmd.exe 36 PID 2808 wrote to memory of 2776 2808 cmd.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Microsoft Corporation INC." /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Corporation INC..exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Microsoft Corporation INC." /tr '"C:\Users\Admin\AppData\Roaming\Microsoft Corporation INC..exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2844
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3331.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2580
-
-
C:\Users\Admin\AppData\Roaming\Microsoft Corporation INC..exe"C:\Users\Admin\AppData\Roaming\Microsoft Corporation INC..exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
170B
MD5ae34785dadb58aacddaa9047894bb706
SHA1b67db763cce1a64ba0b7facaa28a0d7f813141b7
SHA25653294d8b43c866dea0e355e24bcbbbfb043e45ba2590e4b932f839bfd2181973
SHA51220d8f91333188fa8c981a4068270920827332a9d8b1203219c0c9e800bac1f5ba8d4a2344d2ee2d6ad6c8f6f55658171e9c113f85ede29915c294a70be48d47d
-
Filesize
74KB
MD5a3b9079cb3f336a8e010a25d943e74a1
SHA10b0a82a0e91aa10d032f51c3aca80311a43e62e0
SHA256e92ae266c9913cbf2c957fd3425e62443a4c75260ad7327d214129c404260d4e
SHA512b6b23d7f71863c6bb753b256d6b3a053a9860ed09eb1b753faf8520376df54eadecc6f997baf0a4c4c2090274cae9ab751249d1306fece54408f8fcd099ddadc
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b