Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/03/2025, 08:31

250320-ke41kaysct 10

19/03/2025, 18:31

250319-w6aftazxav 7

Analysis

  • max time kernel
    10s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-de
  • resource tags

    arch:x64arch:x86image:win7-20240903-delocale:de-deos:windows7-x64systemwindows
  • submitted
    20/03/2025, 08:31

Errors

Reason
Machine shutdown

General

  • Target

    888 Rat v1.2.6.exe

  • Size

    75.0MB

  • MD5

    ad33064a9ca95c5b3ed45c14b7fe2739

  • SHA1

    0bd1286fa5fd936a31a4514798daffa444ce8e12

  • SHA256

    5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98

  • SHA512

    acb056e217edef4639179b24193a454f7e5aade51c1cc972e0458fc23c0ad982323161ad37050a4d849641dbf84719707efdcf4c99ecdf413381e5a752413647

  • SSDEEP

    1572864:5mhnD+9mK/LnkHD1LYrXatfLllR3RboTmxXlIgU/cNruKPZiv:6nD+UozkJLYrXajR4ElIgU/c5Qv

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe
    "C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1588
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2148
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2304

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\skin.dll

        Filesize

        239KB

        MD5

        29e1d5770184bf45139084bced50d306

        SHA1

        76c953cd86b013c3113f8495b656bd721be55e76

        SHA256

        794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307

        SHA512

        7cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8

      • \Users\Admin\AppData\Local\Temp\skin.888ww.msstyles

        Filesize

        3.3MB

        MD5

        ea5d5266b8a7bcc8788c83ebb7c8c7d5

        SHA1

        3e9ac1ab7d5d54db9b3d141e82916513e572b415

        SHA256

        91ac4d215b8d90aef9a000900c9088d4c33d58c5f35a720a385a3f2d2299e5d1

        SHA512

        404b35fca478a1f489ec1af7be1df897190d7deb0cd8139c2c89d68c24fa377d904cf0c5e30c09ab448d74d87a47aaa3a872bf66a9bc9c124f52798320d34e60

      • memory/1588-41-0x000000000C740000-0x000000000C7FB000-memory.dmp

        Filesize

        748KB

      • memory/1588-46-0x0000000075130000-0x0000000075162000-memory.dmp

        Filesize

        200KB

      • memory/1588-47-0x00000000754A0000-0x000000007553D000-memory.dmp

        Filesize

        628KB

      • memory/1588-48-0x00000000752C0000-0x0000000075360000-memory.dmp

        Filesize

        640KB

      • memory/1588-49-0x0000000077240000-0x0000000077297000-memory.dmp

        Filesize

        348KB

      • memory/1588-50-0x0000000075540000-0x0000000075755000-memory.dmp

        Filesize

        2.1MB

      • memory/1588-45-0x0000000000C00000-0x00000000056FD000-memory.dmp

        Filesize

        75.0MB

      • memory/1588-52-0x0000000075930000-0x0000000075A8C000-memory.dmp

        Filesize

        1.4MB

      • memory/1588-53-0x00000000757F0000-0x000000007587F000-memory.dmp

        Filesize

        572KB

      • memory/1588-51-0x0000000075DC0000-0x0000000076A0A000-memory.dmp

        Filesize

        12.3MB

      • memory/1588-54-0x0000000077110000-0x000000007713A000-memory.dmp

        Filesize

        168KB

      • memory/1588-55-0x0000000074DF0000-0x0000000074E41000-memory.dmp

        Filesize

        324KB

      • memory/1588-59-0x00000000752C0000-0x0000000075360000-memory.dmp

        Filesize

        640KB

      • memory/1588-58-0x0000000075130000-0x0000000075162000-memory.dmp

        Filesize

        200KB

      • memory/1588-57-0x0000000075170000-0x0000000075179000-memory.dmp

        Filesize

        36KB

      • memory/1588-56-0x0000000000C00000-0x00000000056FD000-memory.dmp

        Filesize

        75.0MB

      • memory/1588-62-0x0000000075540000-0x0000000075755000-memory.dmp

        Filesize

        2.1MB

      • memory/1588-61-0x0000000077240000-0x0000000077297000-memory.dmp

        Filesize

        348KB

      • memory/1588-60-0x0000000074F90000-0x000000007512E000-memory.dmp

        Filesize

        1.6MB

      • memory/1588-66-0x0000000075930000-0x0000000075A8C000-memory.dmp

        Filesize

        1.4MB

      • memory/1588-67-0x00000000757F0000-0x000000007587F000-memory.dmp

        Filesize

        572KB

      • memory/1588-65-0x0000000075DC0000-0x0000000076A0A000-memory.dmp

        Filesize

        12.3MB

      • memory/1588-64-0x0000000076A10000-0x0000000076A8B000-memory.dmp

        Filesize

        492KB

      • memory/1588-72-0x00000000754A0000-0x000000007553D000-memory.dmp

        Filesize

        628KB

      • memory/1588-75-0x0000000077240000-0x0000000077297000-memory.dmp

        Filesize

        348KB

      • memory/1588-74-0x0000000074F90000-0x000000007512E000-memory.dmp

        Filesize

        1.6MB

      • memory/1588-73-0x00000000752C0000-0x0000000075360000-memory.dmp

        Filesize

        640KB

      • memory/1588-71-0x0000000075130000-0x0000000075162000-memory.dmp

        Filesize

        200KB

      • memory/1588-83-0x0000000074DF0000-0x0000000074E41000-memory.dmp

        Filesize

        324KB

      • memory/1588-82-0x0000000074E50000-0x0000000074E63000-memory.dmp

        Filesize

        76KB

      • memory/1588-70-0x0000000074DF0000-0x0000000074E41000-memory.dmp

        Filesize

        324KB

      • memory/1588-77-0x0000000075540000-0x0000000075755000-memory.dmp

        Filesize

        2.1MB

      • memory/1588-80-0x00000000757F0000-0x000000007587F000-memory.dmp

        Filesize

        572KB

      • memory/1588-81-0x0000000076CC0000-0x0000000076D8C000-memory.dmp

        Filesize

        816KB

      • memory/1588-79-0x0000000076A10000-0x0000000076A8B000-memory.dmp

        Filesize

        492KB

      • memory/1588-86-0x0000000075130000-0x0000000075162000-memory.dmp

        Filesize

        200KB

      • memory/1588-88-0x0000000074F90000-0x000000007512E000-memory.dmp

        Filesize

        1.6MB

      • memory/1588-91-0x0000000075540000-0x0000000075755000-memory.dmp

        Filesize

        2.1MB

      • memory/1588-94-0x0000000074DF0000-0x0000000074E41000-memory.dmp

        Filesize

        324KB

      • memory/1588-93-0x0000000076CC0000-0x0000000076D8C000-memory.dmp

        Filesize

        816KB

      • memory/1588-90-0x0000000074F70000-0x0000000074F82000-memory.dmp

        Filesize

        72KB

      • memory/1588-89-0x0000000077240000-0x0000000077297000-memory.dmp

        Filesize

        348KB

      • memory/1588-87-0x00000000752C0000-0x0000000075360000-memory.dmp

        Filesize

        640KB

      • memory/1588-85-0x0000000075170000-0x0000000075179000-memory.dmp

        Filesize

        36KB

      • memory/1588-76-0x0000000074F70000-0x0000000074F82000-memory.dmp

        Filesize

        72KB

      • memory/1588-69-0x0000000076CC0000-0x0000000076D8C000-memory.dmp

        Filesize

        816KB

      • memory/1588-103-0x0000000075540000-0x0000000075755000-memory.dmp

        Filesize

        2.1MB

      • memory/1588-114-0x0000000074F90000-0x000000007512E000-memory.dmp

        Filesize

        1.6MB

      • memory/1588-116-0x0000000074F70000-0x0000000074F82000-memory.dmp

        Filesize

        72KB

      • memory/1588-115-0x0000000077240000-0x0000000077297000-memory.dmp

        Filesize

        348KB

      • memory/1588-113-0x0000000075130000-0x0000000075162000-memory.dmp

        Filesize

        200KB

      • memory/1588-84-0x0000000000C00000-0x00000000056FD000-memory.dmp

        Filesize

        75.0MB

      • memory/1588-105-0x0000000076A10000-0x0000000076A8B000-memory.dmp

        Filesize

        492KB

      • memory/1588-109-0x0000000074E50000-0x0000000074E63000-memory.dmp

        Filesize

        76KB

      • memory/1588-111-0x0000000077240000-0x0000000077297000-memory.dmp

        Filesize

        348KB

      • memory/1588-110-0x0000000074DF0000-0x0000000074E41000-memory.dmp

        Filesize

        324KB

      • memory/1588-108-0x0000000076CC0000-0x0000000076D8C000-memory.dmp

        Filesize

        816KB

      • memory/1588-106-0x00000000757F0000-0x000000007587F000-memory.dmp

        Filesize

        572KB

      • memory/1588-102-0x0000000074F70000-0x0000000074F82000-memory.dmp

        Filesize

        72KB

      • memory/1588-101-0x0000000077240000-0x0000000077297000-memory.dmp

        Filesize

        348KB

      • memory/1588-100-0x0000000074F90000-0x000000007512E000-memory.dmp

        Filesize

        1.6MB

      • memory/1588-99-0x00000000752C0000-0x0000000075360000-memory.dmp

        Filesize

        640KB

      • memory/1588-98-0x00000000754A0000-0x000000007553D000-memory.dmp

        Filesize

        628KB

      • memory/1588-97-0x0000000075130000-0x0000000075162000-memory.dmp

        Filesize

        200KB

      • memory/1588-96-0x0000000075170000-0x0000000075179000-memory.dmp

        Filesize

        36KB

      • memory/1588-211-0x000000000C740000-0x000000000C7FB000-memory.dmp

        Filesize

        748KB