Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2025, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.exe
Resource
win7-20240903-en
General
-
Target
RFQ.exe
-
Size
881KB
-
MD5
768bed9843a8a7c96699b27fc40b8819
-
SHA1
4ae495c3540252bef39276bf6e9fc84435f7b7bb
-
SHA256
aa653ad0d107b2d7ab98d4ede0eef147b73fbd7eb2f522f0bf608f833daebe34
-
SHA512
e23d433ac20532c512d2f2db1badbf4a2e43d2c28ff73553e2de79d82a012dbe1afe81d59bc830f4606ff3b54b08cbbcbd2b6448cdb12a3246ffb4607ac93539
-
SSDEEP
12288:TfNeE6xIVKGJA1R1MbXgf+GH4oGSlhA8b06JJe4Ii3QOeGiTJyxwC1ht2ddT+:wE6xcA1LMbDqXm8b0iJ7r6cxvE
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666
Signatures
-
Darkcloud family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1760 powershell.exe 4092 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation RFQ.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1392 set thread context of 4884 1392 RFQ.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1944 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1760 powershell.exe 4092 powershell.exe 4092 powershell.exe 1392 RFQ.exe 1392 RFQ.exe 1760 powershell.exe 1760 powershell.exe 4092 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4884 RFQ.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1760 powershell.exe Token: SeDebugPrivilege 4092 powershell.exe Token: SeDebugPrivilege 1392 RFQ.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4884 RFQ.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1392 wrote to memory of 1760 1392 RFQ.exe 94 PID 1392 wrote to memory of 1760 1392 RFQ.exe 94 PID 1392 wrote to memory of 1760 1392 RFQ.exe 94 PID 1392 wrote to memory of 4092 1392 RFQ.exe 96 PID 1392 wrote to memory of 4092 1392 RFQ.exe 96 PID 1392 wrote to memory of 4092 1392 RFQ.exe 96 PID 1392 wrote to memory of 1944 1392 RFQ.exe 98 PID 1392 wrote to memory of 1944 1392 RFQ.exe 98 PID 1392 wrote to memory of 1944 1392 RFQ.exe 98 PID 1392 wrote to memory of 3216 1392 RFQ.exe 100 PID 1392 wrote to memory of 3216 1392 RFQ.exe 100 PID 1392 wrote to memory of 3216 1392 RFQ.exe 100 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101 PID 1392 wrote to memory of 4884 1392 RFQ.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wOPQRmK.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp49F.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1944
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵PID:3216
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD56781a07d15aa05cae5229e04c0025790
SHA1956171a8e70bb002c0828a03e1df65044da4da85
SHA256107a1852fec5fdb84ec502649e26672661a2c3af92e013e2d04445466434dc0e
SHA51205aa76aa55d720a80a0e07e02f864cfdf49e5928524d169c8ba9296a21c8b0c86cb5b26edff862c9366d7fa4a796fa5b9f9cb7ec47429831384df9bb0c341f46
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD535d70da459ef4d813ba73c3190079601
SHA1bec50d4d968848f09313b3a96c5835d04851f56e
SHA2564cf036bfe77bd7caed068c11ab4590b8797618df5496ebdaf8060df4d8c2b3c0
SHA5123bc651e0dbf61ceae72bfc93d63e1e031c52f11515181a1cfcafd4949e4df70a08cfe54c8276ec385d96ec782e8df9938f5b6d130b6890246b203ee3122e5ac1