Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
4Resubmissions
18/11/2020, 14:18
201118-dj27sn3f52 1018/11/2020, 13:42
201118-1arz86e7w6 1018/11/2020, 13:38
201118-n8jh228ctn 10Analysis
-
max time kernel
1802s -
max time network
1813s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18/11/2020, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
2019-09-02_22-41-10.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral2
Sample
31.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
3DMark 11 Advanced Edition.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral4
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral6
Sample
DiskInternals_Uneraser_v5_keygen.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
ForceOp 2.8.7 - By RaiSence.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral8
Sample
HYDRA.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
Keygen.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral10
Sample
LtHv0O2KZDK4M637.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
OnlineInstaller.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral12
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral14
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral16
Sample
api.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
good.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
infected dot net installer.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
update.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
vir1.xls
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
xNet.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
1.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral24
Sample
VPN/VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
VPN/xNet.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral26
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
General
-
Target
HYDRA.bin.exe
Malware Config
Extracted
smokeloader
2017
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 3108 created 1152 3108 svchost.exe 80 PID 3108 created 1152 3108 svchost.exe 80 -
Executes dropped EXE 10 IoCs
pid Process 1612 yaya.exe 2176 va.exe 2464 ufx.exe 2668 sant.exe 2692 power.exe 1152 starter.exe 2344 usc.exe 1220 usc.exe 2716 usc.exe 2912 usc.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppDataLow = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\gcdhuttv\\jeusrtec.exe" explorer.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum sant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 sant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3432 SCHTASKS.exe 3424 SCHTASKS.exe 4048 SCHTASKS.exe 1444 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe 2668 sant.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2668 sant.exe 2668 sant.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2344 usc.exe Token: SeTcbPrivilege 3108 svchost.exe Token: SeTcbPrivilege 3108 svchost.exe Token: SeDebugPrivilege 1152 starter.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeDebugPrivilege 1220 usc.exe Token: SeDebugPrivilege 2716 usc.exe Token: SeDebugPrivilege 2912 usc.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 756 wrote to memory of 1612 756 HYDRA.bin.exe 74 PID 756 wrote to memory of 1612 756 HYDRA.bin.exe 74 PID 756 wrote to memory of 1612 756 HYDRA.bin.exe 74 PID 756 wrote to memory of 2176 756 HYDRA.bin.exe 75 PID 756 wrote to memory of 2176 756 HYDRA.bin.exe 75 PID 756 wrote to memory of 2176 756 HYDRA.bin.exe 75 PID 756 wrote to memory of 2464 756 HYDRA.bin.exe 76 PID 756 wrote to memory of 2464 756 HYDRA.bin.exe 76 PID 756 wrote to memory of 2464 756 HYDRA.bin.exe 76 PID 756 wrote to memory of 2668 756 HYDRA.bin.exe 77 PID 756 wrote to memory of 2668 756 HYDRA.bin.exe 77 PID 756 wrote to memory of 2668 756 HYDRA.bin.exe 77 PID 756 wrote to memory of 2692 756 HYDRA.bin.exe 78 PID 756 wrote to memory of 2692 756 HYDRA.bin.exe 78 PID 756 wrote to memory of 2692 756 HYDRA.bin.exe 78 PID 1612 wrote to memory of 1152 1612 yaya.exe 80 PID 1612 wrote to memory of 1152 1612 yaya.exe 80 PID 2464 wrote to memory of 2344 2464 ufx.exe 81 PID 2464 wrote to memory of 2344 2464 ufx.exe 81 PID 2464 wrote to memory of 2344 2464 ufx.exe 81 PID 2344 wrote to memory of 3432 2344 usc.exe 83 PID 2344 wrote to memory of 3432 2344 usc.exe 83 PID 2344 wrote to memory of 3432 2344 usc.exe 83 PID 1152 wrote to memory of 2708 1152 starter.exe 85 PID 1152 wrote to memory of 2708 1152 starter.exe 85 PID 2708 wrote to memory of 2408 2708 csc.exe 87 PID 2708 wrote to memory of 2408 2708 csc.exe 87 PID 3108 wrote to memory of 2700 3108 svchost.exe 89 PID 3108 wrote to memory of 2700 3108 svchost.exe 89 PID 3108 wrote to memory of 2396 3108 svchost.exe 90 PID 3108 wrote to memory of 2396 3108 svchost.exe 90 PID 2668 wrote to memory of 1020 2668 sant.exe 94 PID 2668 wrote to memory of 1020 2668 sant.exe 94 PID 2668 wrote to memory of 1020 2668 sant.exe 94 PID 2692 wrote to memory of 560 2692 power.exe 95 PID 2692 wrote to memory of 560 2692 power.exe 95 PID 2692 wrote to memory of 560 2692 power.exe 95 PID 1220 wrote to memory of 3424 1220 usc.exe 98 PID 1220 wrote to memory of 3424 1220 usc.exe 98 PID 1220 wrote to memory of 3424 1220 usc.exe 98 PID 2716 wrote to memory of 4048 2716 usc.exe 101 PID 2716 wrote to memory of 4048 2716 usc.exe 101 PID 2716 wrote to memory of 4048 2716 usc.exe 101 PID 2912 wrote to memory of 1444 2912 usc.exe 104 PID 2912 wrote to memory of 1444 2912 usc.exe 104 PID 2912 wrote to memory of 1444 2912 usc.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\HYDRA.bin.exe"C:\Users\Admin\AppData\Local\Temp\HYDRA.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Roaming\yaya.exeC:\Users\Admin\AppData\Roaming\yaya.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mihbzxcm.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8851.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8850.tmp"5⤵PID:2408
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2700
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2396
-
-
-
-
C:\Users\Admin\AppData\Roaming\va.exeC:\Users\Admin\AppData\Roaming\va.exe2⤵
- Executes dropped EXE
- Drops startup file
PID:2176
-
-
C:\Users\Admin\AppData\Roaming\ufx.exeC:\Users\Admin\AppData\Roaming\ufx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\ProgramData\ucp\usc.exe"C:\ProgramData\ucp\usc.exe" /ucp/usc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe4⤵
- Creates scheduled task(s)
PID:3432
-
-
-
-
C:\Users\Admin\AppData\Roaming\sant.exeC:\Users\Admin\AppData\Roaming\sant.exe2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds Run key to start application
PID:1020
-
-
-
C:\Users\Admin\AppData\Roaming\power.exeC:\Users\Admin\AppData\Roaming\power.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:3424
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:4048
-
-
C:\ProgramData\ucp\usc.exeC:\ProgramData\ucp\usc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe2⤵
- Creates scheduled task(s)
PID:1444
-