Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/03/2025, 21:58
250312-1vyfqat1dx 1012/03/2025, 21:51
250312-1qnqqawkv6 1012/03/2025, 21:45
250312-1mkjwstzcv 10Analysis
-
max time kernel
122s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/03/2025, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
Report.ps1
Resource
win7-20240903-en
General
-
Target
Report.ps1
-
Size
458KB
-
MD5
20d2c488f9ce3e337faf20ea1a9abe47
-
SHA1
ea844520e903e1f7d8f234a057cd3cc778380ae9
-
SHA256
6e7ff182d4509ea804b6ed739ffa2191af2891af164ede9a90e79aea8fee4d1f
-
SHA512
6581df037579fd6684ee4a44d2e631a4aa9c524b47c47fe2afb9434c487824146fb000d9c7a7b63df6c534b00f4a979f24be88019b3ed12d9bf3ce81508b243c
-
SSDEEP
768:llcMsNARzF0NToMotYJKN2C0FIMG9Kl/2:6/2
Malware Config
Extracted
asyncrat
A 14
Default
nams.ddnsfree.com:409
aliomar.ooguy.com:409
MaterxMutex_Egypt409
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2780 set thread context of 2576 2780 powershell.exe 31 -
pid Process 2780 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_compiler.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2576 aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2780 powershell.exe 2576 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2780 powershell.exe Token: SeDebugPrivilege 2576 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2576 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2576 2780 powershell.exe 31 PID 2780 wrote to memory of 2804 2780 powershell.exe 32 PID 2780 wrote to memory of 2804 2780 powershell.exe 32 PID 2780 wrote to memory of 2804 2780 powershell.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Report.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /query /tn administrator2⤵PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD583142242e97b8953c386f988aa694e4a
SHA1833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10
-
Filesize
183KB
MD5109cab5505f5e065b63d01361467a83b
SHA14ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc