Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2025, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
RFQ.exe
Resource
win7-20250207-en
General
-
Target
RFQ.exe
-
Size
881KB
-
MD5
768bed9843a8a7c96699b27fc40b8819
-
SHA1
4ae495c3540252bef39276bf6e9fc84435f7b7bb
-
SHA256
aa653ad0d107b2d7ab98d4ede0eef147b73fbd7eb2f522f0bf608f833daebe34
-
SHA512
e23d433ac20532c512d2f2db1badbf4a2e43d2c28ff73553e2de79d82a012dbe1afe81d59bc830f4606ff3b54b08cbbcbd2b6448cdb12a3246ffb4607ac93539
-
SSDEEP
12288:TfNeE6xIVKGJA1R1MbXgf+GH4oGSlhA8b06JJe4Ii3QOeGiTJyxwC1ht2ddT+:wE6xcA1LMbDqXm8b0iJ7r6cxvE
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666
Signatures
-
Darkcloud family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1372 powershell.exe 1260 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation RFQ.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3648 set thread context of 1328 3648 RFQ.exe 104 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 976 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1372 powershell.exe 1372 powershell.exe 1260 powershell.exe 1260 powershell.exe 3648 RFQ.exe 3648 RFQ.exe 1372 powershell.exe 1260 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1328 RFQ.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1372 powershell.exe Token: SeDebugPrivilege 1260 powershell.exe Token: SeDebugPrivilege 3648 RFQ.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1328 RFQ.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3648 wrote to memory of 1372 3648 RFQ.exe 97 PID 3648 wrote to memory of 1372 3648 RFQ.exe 97 PID 3648 wrote to memory of 1372 3648 RFQ.exe 97 PID 3648 wrote to memory of 1260 3648 RFQ.exe 99 PID 3648 wrote to memory of 1260 3648 RFQ.exe 99 PID 3648 wrote to memory of 1260 3648 RFQ.exe 99 PID 3648 wrote to memory of 976 3648 RFQ.exe 101 PID 3648 wrote to memory of 976 3648 RFQ.exe 101 PID 3648 wrote to memory of 976 3648 RFQ.exe 101 PID 3648 wrote to memory of 1628 3648 RFQ.exe 103 PID 3648 wrote to memory of 1628 3648 RFQ.exe 103 PID 3648 wrote to memory of 1628 3648 RFQ.exe 103 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104 PID 3648 wrote to memory of 1328 3648 RFQ.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wOPQRmK.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF31A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:976
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ.exe"C:\Users\Admin\AppData\Local\Temp\RFQ.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD582ece85538ca3846b821ff566cb15464
SHA13b188b545e89e7ab334ac0a36a7e748b7ef9257d
SHA25625e606ec9dde28a9ab3e91bb58edf585fa675fbe162d73dd22285064f9f7a33d
SHA512482abd893d65cc391e47bfa2fcf9fa66e30e2cbaf2b2a7790eea4a37f630dbf17fdfa387619e78064baf69e76b55637ee76e5c16cdf20a39e8ed6728bd8ba376