Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
8ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
8ฺฺฺ�...�ฺ1m
windows10_x64
3ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
8ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
3ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
3ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
8ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
10ฺฺฺ�...�ฺ1m
windows10_x64
1ฺฺฺ�...�ฺ1m
windows10_x64
3Resubmissions
18/11/2020, 14:18
201118-dj27sn3f52 1018/11/2020, 13:42
201118-1arz86e7w6 1018/11/2020, 13:38
201118-n8jh228ctn 10Analysis
-
max time kernel
63s -
max time network
75s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18/11/2020, 13:38
Static task
static1
Behavioral task
behavioral1
Sample
2019-09-02_22-41-10.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral2
Sample
31.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
3DMark 11 Advanced Edition.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral4
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral6
Sample
DiskInternals_Uneraser_v5_keygen.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
ForceOp 2.8.7 - By RaiSence.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral8
Sample
HYDRA.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
Keygen.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral10
Sample
LtHv0O2KZDK4M637.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
OnlineInstaller.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral12
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral14
Sample
VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral16
Sample
api.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral18
Sample
good.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
infected dot net installer.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral20
Sample
update.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
vir1.xls
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral22
Sample
xNet.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
1.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral24
Sample
VPN/VyprVPN.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
VPN/xNet.dll
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral26
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
windows10_x64
General
-
Target
HYDRA.bin.exe
Malware Config
Extracted
smokeloader
2017
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 3580 created 3628 3580 svchost.exe 80 PID 3580 created 3628 3580 svchost.exe 80 -
Executes dropped EXE 7 IoCs
pid Process 1212 yaya.exe 3988 va.exe 1788 ufx.exe 2032 sant.exe 2160 power.exe 3628 starter.exe 2136 usc.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Netscape = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\agtbbret\\jdvjwcit.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum sant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 sant.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1780 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe 2032 sant.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2032 sant.exe 2032 sant.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2136 usc.exe Token: SeTcbPrivilege 3580 svchost.exe Token: SeTcbPrivilege 3580 svchost.exe Token: SeDebugPrivilege 3628 starter.exe Token: SeDebugPrivilege 3752 powershell.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 4040 wrote to memory of 1212 4040 HYDRA.bin.exe 73 PID 4040 wrote to memory of 1212 4040 HYDRA.bin.exe 73 PID 4040 wrote to memory of 1212 4040 HYDRA.bin.exe 73 PID 4040 wrote to memory of 3988 4040 HYDRA.bin.exe 74 PID 4040 wrote to memory of 3988 4040 HYDRA.bin.exe 74 PID 4040 wrote to memory of 3988 4040 HYDRA.bin.exe 74 PID 4040 wrote to memory of 1788 4040 HYDRA.bin.exe 75 PID 4040 wrote to memory of 1788 4040 HYDRA.bin.exe 75 PID 4040 wrote to memory of 1788 4040 HYDRA.bin.exe 75 PID 4040 wrote to memory of 2032 4040 HYDRA.bin.exe 76 PID 4040 wrote to memory of 2032 4040 HYDRA.bin.exe 76 PID 4040 wrote to memory of 2032 4040 HYDRA.bin.exe 76 PID 4040 wrote to memory of 2160 4040 HYDRA.bin.exe 77 PID 4040 wrote to memory of 2160 4040 HYDRA.bin.exe 77 PID 4040 wrote to memory of 2160 4040 HYDRA.bin.exe 77 PID 1212 wrote to memory of 3628 1212 yaya.exe 80 PID 1212 wrote to memory of 3628 1212 yaya.exe 80 PID 1788 wrote to memory of 2136 1788 ufx.exe 81 PID 1788 wrote to memory of 2136 1788 ufx.exe 81 PID 1788 wrote to memory of 2136 1788 ufx.exe 81 PID 2136 wrote to memory of 1780 2136 usc.exe 83 PID 2136 wrote to memory of 1780 2136 usc.exe 83 PID 2136 wrote to memory of 1780 2136 usc.exe 83 PID 3628 wrote to memory of 3060 3628 starter.exe 85 PID 3628 wrote to memory of 3060 3628 starter.exe 85 PID 3060 wrote to memory of 3160 3060 csc.exe 87 PID 3060 wrote to memory of 3160 3060 csc.exe 87 PID 3580 wrote to memory of 1512 3580 svchost.exe 89 PID 3580 wrote to memory of 1512 3580 svchost.exe 89 PID 3580 wrote to memory of 1516 3580 svchost.exe 90 PID 3580 wrote to memory of 1516 3580 svchost.exe 90 PID 2032 wrote to memory of 2212 2032 sant.exe 94 PID 2032 wrote to memory of 2212 2032 sant.exe 94 PID 2032 wrote to memory of 2212 2032 sant.exe 94 PID 2160 wrote to memory of 3752 2160 power.exe 95 PID 2160 wrote to memory of 3752 2160 power.exe 95 PID 2160 wrote to memory of 3752 2160 power.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\HYDRA.bin.exe"C:\Users\Admin\AppData\Local\Temp\HYDRA.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Roaming\yaya.exeC:\Users\Admin\AppData\Roaming\yaya.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2xaeabdi.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7ECC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7EBB.tmp"5⤵PID:3160
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:1512
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:1516
-
-
-
-
C:\Users\Admin\AppData\Roaming\va.exeC:\Users\Admin\AppData\Roaming\va.exe2⤵
- Executes dropped EXE
- Drops startup file
PID:3988
-
-
C:\Users\Admin\AppData\Roaming\ufx.exeC:\Users\Admin\AppData\Roaming\ufx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\ProgramData\ucp\usc.exe"C:\ProgramData\ucp\usc.exe" /ucp/usc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe4⤵
- Creates scheduled task(s)
PID:1780
-
-
-
-
C:\Users\Admin\AppData\Roaming\sant.exeC:\Users\Admin\AppData\Roaming\sant.exe2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds Run key to start application
PID:2212
-
-
-
C:\Users\Admin\AppData\Roaming\power.exeC:\Users\Admin\AppData\Roaming\power.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580