Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe
Resource
win10v2004-20220812-en
General
-
Target
7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe
-
Size
128KB
-
MD5
a4b06792bbb73e3a1a302517f7eeba6d
-
SHA1
f3c01fee3204bf8d2010bc92bdd1301d7e9f0d73
-
SHA256
7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595
-
SHA512
593725354388af2e13fada0701c2b0343e2d0944434c0376c8fad3910a8cfbe6881b372a103ba9208b4786aadfb2114c70a33d7f53f33b8b265d9c9bb422255d
-
SSDEEP
3072:B0d4nDbfagCqKZk5yY/NdknZpepjBW/aWVPLQ7TjTgUtnRMr:yd4nDWgRAkPOZI/GrVPswUrA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1920 caycwq.exe -
Deletes itself 1 IoCs
pid Process 1460 cmd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\caycwq.exe 7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe File opened for modification C:\Windows\SysWOW64\caycwq.exe 7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 caycwq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz caycwq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1896 7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1896 wrote to memory of 1460 1896 7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe 29 PID 1896 wrote to memory of 1460 1896 7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe 29 PID 1896 wrote to memory of 1460 1896 7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe 29 PID 1896 wrote to memory of 1460 1896 7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe"C:\Users\Admin\AppData\Local\Temp\7b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7B9860~1.EXE > nul2⤵
- Deletes itself
PID:1460
-
-
C:\Windows\SysWOW64\caycwq.exeC:\Windows\SysWOW64\caycwq.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1920
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5a4b06792bbb73e3a1a302517f7eeba6d
SHA1f3c01fee3204bf8d2010bc92bdd1301d7e9f0d73
SHA2567b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595
SHA512593725354388af2e13fada0701c2b0343e2d0944434c0376c8fad3910a8cfbe6881b372a103ba9208b4786aadfb2114c70a33d7f53f33b8b265d9c9bb422255d
-
Filesize
128KB
MD5a4b06792bbb73e3a1a302517f7eeba6d
SHA1f3c01fee3204bf8d2010bc92bdd1301d7e9f0d73
SHA2567b98601cdf3dc125e18217e24207a1631f3f4aa9c0c10e1c101e98801d75f595
SHA512593725354388af2e13fada0701c2b0343e2d0944434c0376c8fad3910a8cfbe6881b372a103ba9208b4786aadfb2114c70a33d7f53f33b8b265d9c9bb422255d