Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-de -
resource tags
arch:x64arch:x86image:win7-20240903-delocale:de-deos:windows7-x64systemwindows -
submitted
20/03/2025, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
888 Rat v1.2.6.exe
Resource
win10v2004-20250314-de
Behavioral task
behavioral2
Sample
888 Rat v1.2.6.exe
Resource
win10ltsc2021-20250314-de
Behavioral task
behavioral3
Sample
888 Rat v1.2.6.exe
Resource
win11-20250314-de
Errors
General
-
Target
888 Rat v1.2.6.exe
-
Size
75.0MB
-
MD5
ad33064a9ca95c5b3ed45c14b7fe2739
-
SHA1
0bd1286fa5fd936a31a4514798daffa444ce8e12
-
SHA256
5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98
-
SHA512
acb056e217edef4639179b24193a454f7e5aade51c1cc972e0458fc23c0ad982323161ad37050a4d849641dbf84719707efdcf4c99ecdf413381e5a752413647
-
SSDEEP
1572864:5mhnD+9mK/LnkHD1LYrXatfLllR3RboTmxXlIgU/cNruKPZiv:6nD+UozkJLYrXajR4ElIgU/c5Qv
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral4/files/0x0008000000016c89-37.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 1588 888 Rat v1.2.6.exe 1588 888 Rat v1.2.6.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral4/memory/1588-45-0x0000000000C00000-0x00000000056FD000-memory.dmp autoit_exe behavioral4/memory/1588-56-0x0000000000C00000-0x00000000056FD000-memory.dmp autoit_exe behavioral4/memory/1588-84-0x0000000000C00000-0x00000000056FD000-memory.dmp autoit_exe -
resource yara_rule behavioral4/files/0x0008000000016c89-37.dat upx behavioral4/memory/1588-41-0x000000000C740000-0x000000000C7FB000-memory.dmp upx behavioral4/memory/1588-211-0x000000000C740000-0x000000000C7FB000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 888 Rat v1.2.6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1588 888 Rat v1.2.6.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1588 888 Rat v1.2.6.exe 1588 888 Rat v1.2.6.exe 1588 888 Rat v1.2.6.exe 1588 888 Rat v1.2.6.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1588 888 Rat v1.2.6.exe 1588 888 Rat v1.2.6.exe 1588 888 Rat v1.2.6.exe 1588 888 Rat v1.2.6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1588 888 Rat v1.2.6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe"C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1588
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2148
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD529e1d5770184bf45139084bced50d306
SHA176c953cd86b013c3113f8495b656bd721be55e76
SHA256794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307
SHA5127cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8
-
Filesize
3.3MB
MD5ea5d5266b8a7bcc8788c83ebb7c8c7d5
SHA13e9ac1ab7d5d54db9b3d141e82916513e572b415
SHA25691ac4d215b8d90aef9a000900c9088d4c33d58c5f35a720a385a3f2d2299e5d1
SHA512404b35fca478a1f489ec1af7be1df897190d7deb0cd8139c2c89d68c24fa377d904cf0c5e30c09ab448d74d87a47aaa3a872bf66a9bc9c124f52798320d34e60