Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
103c7b097b31...0f.exe
windows7-x64
83c7b097b31...0f.exe
windows10-2004-x64
83c8a6c6cde...86.exe
windows7-x64
103c8a6c6cde...86.exe
windows10-2004-x64
103ca3e4676b...f1.exe
windows7-x64
103ca3e4676b...f1.exe
windows10-2004-x64
103cb47c4bbe...c1.exe
windows7-x64
103cb47c4bbe...c1.exe
windows10-2004-x64
103d18edb3bf...ff.exe
windows7-x64
13d18edb3bf...ff.exe
windows10-2004-x64
3d1ee6caf0...b4.exe
windows7-x64
103d1ee6caf0...b4.exe
windows10-2004-x64
103d2f05086d...0c.exe
windows7-x64
103d2f05086d...0c.exe
windows10-2004-x64
103d81f411b0...ba.exe
windows7-x64
103d81f411b0...ba.exe
windows10-2004-x64
103d90976d58...8c.exe
windows7-x64
103d90976d58...8c.exe
windows10-2004-x64
103d97ea72c5...9e.exe
windows7-x64
103d97ea72c5...9e.exe
windows10-2004-x64
103dd452b939...18.exe
windows7-x64
33dd452b939...18.exe
windows10-2004-x64
33dfc71cfc4...bd.exe
windows7-x64
103dfc71cfc4...bd.exe
windows10-2004-x64
103e435c9ff2...57.exe
windows7-x64
103e435c9ff2...57.exe
windows10-2004-x64
103e624f48a8...2b.exe
windows7-x64
13e624f48a8...2b.exe
windows10-2004-x64
43e8acfab95...cc.exe
windows7-x64
103e8acfab95...cc.exe
windows10-2004-x64
103e9a136b97...9d.exe
windows7-x64
103e9a136b97...9d.exe
windows10-2004-x64
10Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral27
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win10v2004-20250314-en
General
-
Target
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
-
Size
78KB
-
MD5
3ca3e4676bac76c4f7eaf0ab169b8af1
-
SHA1
3873da68bc51d374243468d08e73058674ea0a02
-
SHA256
572c49454d971b5cebc708b888e42970a4f954d97cdd8cd237a5ce4b281c60a7
-
SHA512
2f34a5d1affdada1686408f5f6ac748fd688215a2a12acf897f06af177ad103dbae344102b271b572a5e51ec11b68d97b7d2fa184244ce67d5ea8430f85f1e4e
-
SSDEEP
1536:bCHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtN9/t1+S:bCHFq3Ln7N041QqhgN9/Z
Malware Config
Signatures
-
MetamorpherRAT
Metamorpherrat is a hacking tool that has been around for a while since 2013.
-
Metamorpherrat family
-
Executes dropped EXE 1 IoCs
pid Process 2676 tmp86DC.tmp.exe -
Loads dropped DLL 2 IoCs
pid Process 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\System.XML = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AppLaunch.exe\"" tmp86DC.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp86DC.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ca3e4676bac76c4f7eaf0ab169b8af1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe Token: SeDebugPrivilege 2676 tmp86DC.tmp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2160 wrote to memory of 3036 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 28 PID 2160 wrote to memory of 3036 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 28 PID 2160 wrote to memory of 3036 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 28 PID 2160 wrote to memory of 3036 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 28 PID 3036 wrote to memory of 2072 3036 vbc.exe 30 PID 3036 wrote to memory of 2072 3036 vbc.exe 30 PID 3036 wrote to memory of 2072 3036 vbc.exe 30 PID 3036 wrote to memory of 2072 3036 vbc.exe 30 PID 2160 wrote to memory of 2676 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 31 PID 2160 wrote to memory of 2676 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 31 PID 2160 wrote to memory of 2676 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 31 PID 2160 wrote to memory of 2676 2160 3ca3e4676bac76c4f7eaf0ab169b8af1.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ca3e4676bac76c4f7eaf0ab169b8af1.exe"C:\Users\Admin\AppData\Local\Temp\3ca3e4676bac76c4f7eaf0ab169b8af1.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zkkawqep.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8788.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8787.tmp"3⤵
- System Location Discovery: System Language Discovery
PID:2072
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp86DC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp86DC.tmp.exe" C:\Users\Admin\AppData\Local\Temp\3ca3e4676bac76c4f7eaf0ab169b8af1.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD583be2aae8b171299f79293dabf0fdf35
SHA138cf9be53f425942ef3b485446f9a875167476fc
SHA25671781ea44ccf9c492fdf0ec6b8c895ba52540e91a24daa775d15ddc04e2b7fe4
SHA5121aaf7db1ce856c01fb328ec8070f8f75d90b97268f0d7066b8d2052758f1c5590503216acf4680e7ceb88c403f0bdd1cd4aaa3309f4a43179f7badfe8229a481
-
Filesize
78KB
MD5b41f0fad9ab5115c05549ead2a2ed685
SHA1a20b332e9280d204a41bcdb465cdb1e69262d0fa
SHA2564292f5a5a4e8503733ef3626545dc848b1b6cadca105f6cd1c4986507a013c15
SHA512fe09962026f9523b7195efcc5bc9b11bab63c13052ab10d7d16e57f9d24ef96b6fab49d8f0cbc10616c76d7e7ac18541cd25f599c9005f1ffc736e076850bad8
-
Filesize
660B
MD5a1682afc9684670f50a39048dff20813
SHA1400e7673d48903ea6edddb10066fc4a778590fd6
SHA2567c6743991c72e827a8224751e2ff3502881277ea2c8de3a2f25cf5128957cc05
SHA512611509077c5598477737f232649bf03146fd35f2d580fe93d2828f63bbd33a589540e0498d77f34e91c7fb07e2a2d2ccce765d3b5f2fc5c7c7c56dacda819502
-
Filesize
62KB
MD5aa4bdac8c4e0538ec2bb4b7574c94192
SHA1ef76d834232b67b27ebd75708922adea97aeacce
SHA256d7dbe167a7b64a4d11e76d172c8c880020fe7e4bc9cae977ac06982584a6b430
SHA5120ec342286c9dbe78dd7a371afaf405232ff6242f7e024c6640b265ba2288771297edbb5a6482848daad5007aef503e92508f1a7e1a8b8ff3fe20343b21421a65
-
Filesize
15KB
MD5e8db4e7461bbe85e77328af803322b1a
SHA17270e0a6e1fecf3430546b1e7d4a67cd4c249b1d
SHA2569024bf5994f2cdb0b70ff059cd91ed01370465010a8a361e27ac3b9373adfbd8
SHA512c95a4739a2da651062a1b75706fbbec14b838ce07a0815bed7c13075a3bc90d0b06477a9adeb52a218aa139a909bc0133c4487f7354e2893c427ec5429d000f1
-
Filesize
266B
MD5b4a476895dd88e9f9cc10a936611a2dd
SHA14477f311c71162e770e3b22a9d451a39b6d22112
SHA2561bd40432b6243cf22be7c711e5d21cb49b5b0cbec86e8b0e32773627a63f5913
SHA512b6f35eff2dbed544b349de73687ff60b0dd1b6d2bb671ac5f2a469ddd62aab6c4cdf24ca400f6f5b40efc993cdef465b39dc6ca5ad8af8b51fa4ed497ebf40bb