Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/03/2025, 08:31

250320-ke41kaysct 10

19/03/2025, 18:31

250319-w6aftazxav 7

Analysis

  • max time kernel
    156s
  • max time network
    167s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-de
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-delocale:de-deos:windows10-ltsc_2021-x64systemwindows
  • submitted
    20/03/2025, 08:31

General

  • Target

    888 Rat v1.2.6.exe

  • Size

    75.0MB

  • MD5

    ad33064a9ca95c5b3ed45c14b7fe2739

  • SHA1

    0bd1286fa5fd936a31a4514798daffa444ce8e12

  • SHA256

    5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98

  • SHA512

    acb056e217edef4639179b24193a454f7e5aade51c1cc972e0458fc23c0ad982323161ad37050a4d849641dbf84719707efdcf4c99ecdf413381e5a752413647

  • SSDEEP

    1572864:5mhnD+9mK/LnkHD1LYrXatfLllR3RboTmxXlIgU/cNruKPZiv:6nD+UozkJLYrXajR4ElIgU/c5Qv

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 4 IoCs
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe
    "C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\skin.888ww.msstyles

    Filesize

    3.3MB

    MD5

    ea5d5266b8a7bcc8788c83ebb7c8c7d5

    SHA1

    3e9ac1ab7d5d54db9b3d141e82916513e572b415

    SHA256

    91ac4d215b8d90aef9a000900c9088d4c33d58c5f35a720a385a3f2d2299e5d1

    SHA512

    404b35fca478a1f489ec1af7be1df897190d7deb0cd8139c2c89d68c24fa377d904cf0c5e30c09ab448d74d87a47aaa3a872bf66a9bc9c124f52798320d34e60

  • C:\Users\Admin\AppData\Local\Temp\skin.dll

    Filesize

    239KB

    MD5

    29e1d5770184bf45139084bced50d306

    SHA1

    76c953cd86b013c3113f8495b656bd721be55e76

    SHA256

    794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307

    SHA512

    7cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8

  • memory/4372-38-0x000000000DC00000-0x000000000DCBB000-memory.dmp

    Filesize

    748KB

  • memory/4372-44-0x00000000752A0000-0x000000007531D000-memory.dmp

    Filesize

    500KB

  • memory/4372-49-0x00000000752A0000-0x000000007531D000-memory.dmp

    Filesize

    500KB

  • memory/4372-47-0x00000000752A0000-0x000000007531D000-memory.dmp

    Filesize

    500KB

  • memory/4372-46-0x00000000752A0000-0x000000007531D000-memory.dmp

    Filesize

    500KB

  • memory/4372-50-0x00000000759D0000-0x00000000759F5000-memory.dmp

    Filesize

    148KB

  • memory/4372-53-0x00000000759D0000-0x00000000759F5000-memory.dmp

    Filesize

    148KB

  • memory/4372-52-0x00000000752A0000-0x000000007531D000-memory.dmp

    Filesize

    500KB

  • memory/4372-43-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-48-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-45-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-55-0x00000000759D0000-0x00000000759F5000-memory.dmp

    Filesize

    148KB

  • memory/4372-57-0x0000000076A20000-0x0000000076ACF000-memory.dmp

    Filesize

    700KB

  • memory/4372-56-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-51-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-59-0x0000000076120000-0x0000000076203000-memory.dmp

    Filesize

    908KB

  • memory/4372-58-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-54-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-65-0x0000000074960000-0x00000000749D4000-memory.dmp

    Filesize

    464KB

  • memory/4372-67-0x0000000075320000-0x00000000753F3000-memory.dmp

    Filesize

    844KB

  • memory/4372-64-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-63-0x0000000076A20000-0x0000000076ACF000-memory.dmp

    Filesize

    700KB

  • memory/4372-62-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-61-0x00000000767F0000-0x00000000768D6000-memory.dmp

    Filesize

    920KB

  • memory/4372-66-0x0000000076120000-0x0000000076203000-memory.dmp

    Filesize

    908KB

  • memory/4372-60-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-75-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-73-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-72-0x0000000074960000-0x00000000749D4000-memory.dmp

    Filesize

    464KB

  • memory/4372-78-0x0000000075320000-0x00000000753F3000-memory.dmp

    Filesize

    844KB

  • memory/4372-81-0x0000000076A20000-0x0000000076ACF000-memory.dmp

    Filesize

    700KB

  • memory/4372-83-0x0000000074960000-0x00000000749D4000-memory.dmp

    Filesize

    464KB

  • memory/4372-84-0x0000000075320000-0x00000000753F3000-memory.dmp

    Filesize

    844KB

  • memory/4372-82-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-80-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-77-0x00000000759D0000-0x00000000759F5000-memory.dmp

    Filesize

    148KB

  • memory/4372-76-0x0000000074960000-0x00000000749D4000-memory.dmp

    Filesize

    464KB

  • memory/4372-88-0x0000000076A20000-0x0000000076ACF000-memory.dmp

    Filesize

    700KB

  • memory/4372-87-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-92-0x0000000075320000-0x00000000753F3000-memory.dmp

    Filesize

    844KB

  • memory/4372-89-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-102-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-100-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-101-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-103-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-85-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-109-0x0000000075320000-0x00000000753F3000-memory.dmp

    Filesize

    844KB

  • memory/4372-108-0x0000000074960000-0x00000000749D4000-memory.dmp

    Filesize

    464KB

  • memory/4372-106-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-104-0x0000000074960000-0x00000000749D4000-memory.dmp

    Filesize

    464KB

  • memory/4372-99-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-98-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-96-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-97-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-95-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-94-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-91-0x0000000076120000-0x0000000076203000-memory.dmp

    Filesize

    908KB

  • memory/4372-90-0x0000000074960000-0x00000000749D4000-memory.dmp

    Filesize

    464KB

  • memory/4372-79-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-86-0x00000000767F0000-0x00000000768D6000-memory.dmp

    Filesize

    920KB

  • memory/4372-68-0x0000000000920000-0x000000000541D000-memory.dmp

    Filesize

    75.0MB

  • memory/4372-74-0x0000000076A20000-0x0000000076ACF000-memory.dmp

    Filesize

    700KB

  • memory/4372-71-0x0000000076C50000-0x0000000077227000-memory.dmp

    Filesize

    5.8MB

  • memory/4372-69-0x0000000074ED0000-0x00000000750E0000-memory.dmp

    Filesize

    2.1MB

  • memory/4372-70-0x0000000076A20000-0x0000000076ACF000-memory.dmp

    Filesize

    700KB

  • memory/4372-132-0x000000000DC00000-0x000000000DCBB000-memory.dmp

    Filesize

    748KB

  • memory/4372-133-0x000000000DC00000-0x000000000DCBB000-memory.dmp

    Filesize

    748KB

  • memory/4372-221-0x000000000DC00000-0x000000000DCBB000-memory.dmp

    Filesize

    748KB