Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27/02/2022, 22:24
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
tmp.exe
-
Size
1.1MB
-
MD5
d6df53506b123f5717463d0355336979
-
SHA1
7720fb4b89a4ebcef32a6d6a9a7a88c65cad2c14
-
SHA256
70969f1d56ec1ddcae3fc50545c0a351b798226c62d870db8ae5170eeec67694
-
SHA512
1bfefa221ed77ef05fc72fbc20a322cae990b2a33a9af47b9ee4d9fa1c09d5c81f6a8fd8496ed43a47ee2862e1e2bf1651b4cca2f5e9e23e491c3d4b3249ad2f
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral1/memory/992-66-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 3 IoCs
pid Process 992 ._cache_tmp.exe 564 Synaptics.exe 1564 Peahrfb.exe -
Loads dropped DLL 4 IoCs
pid Process 1796 tmp.exe 1796 tmp.exe 1796 tmp.exe 1796 tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" tmp.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: ._cache_tmp.exe File opened (read-only) \??\F: ._cache_tmp.exe File opened (read-only) \??\G: ._cache_tmp.exe File opened (read-only) \??\J: ._cache_tmp.exe File opened (read-only) \??\L: ._cache_tmp.exe File opened (read-only) \??\V: ._cache_tmp.exe File opened (read-only) \??\W: ._cache_tmp.exe File opened (read-only) \??\U: ._cache_tmp.exe File opened (read-only) \??\E: ._cache_tmp.exe File opened (read-only) \??\M: ._cache_tmp.exe File opened (read-only) \??\N: ._cache_tmp.exe File opened (read-only) \??\P: ._cache_tmp.exe File opened (read-only) \??\Q: ._cache_tmp.exe File opened (read-only) \??\R: ._cache_tmp.exe File opened (read-only) \??\O: ._cache_tmp.exe File opened (read-only) \??\T: ._cache_tmp.exe File opened (read-only) \??\Z: ._cache_tmp.exe File opened (read-only) \??\B: ._cache_tmp.exe File opened (read-only) \??\H: ._cache_tmp.exe File opened (read-only) \??\I: ._cache_tmp.exe File opened (read-only) \??\K: ._cache_tmp.exe File opened (read-only) \??\S: ._cache_tmp.exe File opened (read-only) \??\X: ._cache_tmp.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Peahrfb.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe ._cache_tmp.exe File opened for modification C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe ._cache_tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ._cache_tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ._cache_tmp.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8\WpadDecisionReason = "1" Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8\WpadDecision = "0" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C} Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8 Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadDecisionTime = e060c143312cd801 Peahrfb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadNetworkName = "Network 3" Peahrfb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\86-63-c1-d4-8a-b8 Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0086000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadDecision = "0" Peahrfb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-63-c1-d4-8a-b8\WpadDecisionTime = e060c143312cd801 Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Peahrfb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D30ABE8B-D206-49DC-A416-17EBD1F6D19C}\WpadDecisionReason = "1" Peahrfb.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 992 ._cache_tmp.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1796 wrote to memory of 992 1796 tmp.exe 27 PID 1796 wrote to memory of 992 1796 tmp.exe 27 PID 1796 wrote to memory of 992 1796 tmp.exe 27 PID 1796 wrote to memory of 992 1796 tmp.exe 27 PID 1796 wrote to memory of 564 1796 tmp.exe 28 PID 1796 wrote to memory of 564 1796 tmp.exe 28 PID 1796 wrote to memory of 564 1796 tmp.exe 28 PID 1796 wrote to memory of 564 1796 tmp.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:992
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
PID:564
-
-
C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe"C:\Program Files (x86)\Microsoft Eeuaeq\Peahrfb.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1564