Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/03/2025, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.exe
Resource
win7-20240903-en
General
-
Target
RFQ.exe
-
Size
881KB
-
MD5
768bed9843a8a7c96699b27fc40b8819
-
SHA1
4ae495c3540252bef39276bf6e9fc84435f7b7bb
-
SHA256
aa653ad0d107b2d7ab98d4ede0eef147b73fbd7eb2f522f0bf608f833daebe34
-
SHA512
e23d433ac20532c512d2f2db1badbf4a2e43d2c28ff73553e2de79d82a012dbe1afe81d59bc830f4606ff3b54b08cbbcbd2b6448cdb12a3246ffb4607ac93539
-
SSDEEP
12288:TfNeE6xIVKGJA1R1MbXgf+GH4oGSlhA8b06JJe4Ii3QOeGiTJyxwC1ht2ddT+:wE6xcA1LMbDqXm8b0iJ7r6cxvE
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666
Signatures
-
Darkcloud family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1932 powershell.exe 2832 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2360 set thread context of 2780 2360 RFQ.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2884 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1932 powershell.exe 2832 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2780 RFQ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 2832 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2780 RFQ.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1932 2360 RFQ.exe 31 PID 2360 wrote to memory of 1932 2360 RFQ.exe 31 PID 2360 wrote to memory of 1932 2360 RFQ.exe 31 PID 2360 wrote to memory of 1932 2360 RFQ.exe 31 PID 2360 wrote to memory of 2832 2360 RFQ.exe 33 PID 2360 wrote to memory of 2832 2360 RFQ.exe 33 PID 2360 wrote to memory of 2832 2360 RFQ.exe 33 PID 2360 wrote to memory of 2832 2360 RFQ.exe 33 PID 2360 wrote to memory of 2884 2360 RFQ.exe 34 PID 2360 wrote to memory of 2884 2360 RFQ.exe 34 PID 2360 wrote to memory of 2884 2360 RFQ.exe 34 PID 2360 wrote to memory of 2884 2360 RFQ.exe 34 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37 PID 2360 wrote to memory of 2780 2360 RFQ.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wOPQRmK.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6A0.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a09b98921a81e84e67b3596c9b1f1e87
SHA186b20b73a2591b2103dbb3b0c3b7187e099febfe
SHA2569918531e1ff588ed49440b6629c03cacc70192eb9c37985dd23d9691655edead
SHA5124d1b5a6116079722db78ef8a9678badac59c8c1179e4fc34c51bd4b73026e01867e89f00852dff151c93cc097171382d107db9b252a51be8421f4ffe7a499aaf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BZE3SI60ICBVIDKG6403.temp
Filesize7KB
MD5c33f68c304c84e43390d6b3776847f2b
SHA1305c9ec6c7f97d421bc8bc65f3ad2d5afec60f79
SHA256ac38ea1689e7641f8d322bf762248241e1a4ab24a1d9eac58cecdb7107563d16
SHA512a6152a041b98a71d3e0283193847df273e40921fbf369fd533caea837564220ab41b295c497355a9fdc1d9bd5d9ebc074007782d1a593fa59d2ab25409422a13