Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe
Resource
win10v2004-20220812-en
General
-
Target
9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe
-
Size
303KB
-
MD5
350b3d01b32a7a59549c3c238147ef46
-
SHA1
6fd1f251697bf235173161de440fd0fdd09cac57
-
SHA256
9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243
-
SHA512
7051135d89fa6e60d49450b568c93e0d842516ff05700ad8e4c46584eba2f68c9213f74bd71937e0edbf7180072eef8aa5e61d9dee3b71085f9af033ff6d4fac
-
SSDEEP
6144:ljFbxMdwB442mNFzpKbkYAstrnem80uZe:lt/lpz+TB8Re
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1728 xiehv.exe -
Deletes itself 1 IoCs
pid Process 696 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\Currentversion\Run xiehv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7BD94DA8-4FEF-AD4D-5225-887A4931AB67} = "C:\\Users\\Admin\\AppData\\Roaming\\Yzqou\\xiehv.exe" xiehv.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1132 set thread context of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Privacy 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe 1728 xiehv.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 1728 xiehv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1132 wrote to memory of 1728 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 28 PID 1132 wrote to memory of 1728 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 28 PID 1132 wrote to memory of 1728 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 28 PID 1132 wrote to memory of 1728 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 28 PID 1728 wrote to memory of 1116 1728 xiehv.exe 21 PID 1728 wrote to memory of 1116 1728 xiehv.exe 21 PID 1728 wrote to memory of 1116 1728 xiehv.exe 21 PID 1728 wrote to memory of 1116 1728 xiehv.exe 21 PID 1728 wrote to memory of 1116 1728 xiehv.exe 21 PID 1728 wrote to memory of 1176 1728 xiehv.exe 20 PID 1728 wrote to memory of 1176 1728 xiehv.exe 20 PID 1728 wrote to memory of 1176 1728 xiehv.exe 20 PID 1728 wrote to memory of 1176 1728 xiehv.exe 20 PID 1728 wrote to memory of 1176 1728 xiehv.exe 20 PID 1728 wrote to memory of 1216 1728 xiehv.exe 13 PID 1728 wrote to memory of 1216 1728 xiehv.exe 13 PID 1728 wrote to memory of 1216 1728 xiehv.exe 13 PID 1728 wrote to memory of 1216 1728 xiehv.exe 13 PID 1728 wrote to memory of 1216 1728 xiehv.exe 13 PID 1728 wrote to memory of 1132 1728 xiehv.exe 27 PID 1728 wrote to memory of 1132 1728 xiehv.exe 27 PID 1728 wrote to memory of 1132 1728 xiehv.exe 27 PID 1728 wrote to memory of 1132 1728 xiehv.exe 27 PID 1728 wrote to memory of 1132 1728 xiehv.exe 27 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29 PID 1132 wrote to memory of 696 1132 9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe 29
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe"C:\Users\Admin\AppData\Local\Temp\9d6fe6d45536ea310c293686c9af3944ff6cfdc92655b1f8a581c995245d8243.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Roaming\Yzqou\xiehv.exe"C:\Users\Admin\AppData\Roaming\Yzqou\xiehv.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1728
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpbea62cbf.bat"3⤵
- Deletes itself
PID:696
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD5b11ba999f410aa0dc2607796006346c1
SHA1dfe35f721221788b1f690c29f8915d97b397cb8b
SHA25685f6ff94635a5dc54f08a8201bb4f721b5fe68c8e534c73bcef25bc916378851
SHA51209c58e47a49de799d4aac1470c3db45457d79570def919425fda2a9a20ea715a217060fc7418edda7b2d5bbf889fae7e230279e8d22997b4c3812f868da270f7
-
Filesize
303KB
MD5dca0c059061d95d1bcfc71100d3b35e2
SHA12ad6a1c611bd28b08e1f4a68933dc2557a60d67c
SHA2566c9c90057fdfc01b2bf257ce8763bd380f9abee362f8f60b51e309bfab4a4e2e
SHA512c10eab3ad1a38da30ba02e3ac12fe16ef87e87000a92a551cb5dba74404125f06e5fa1935a525b21111253341e8892abe708b0e708b5039e1fb9f46bb4680a1a
-
Filesize
303KB
MD5dca0c059061d95d1bcfc71100d3b35e2
SHA12ad6a1c611bd28b08e1f4a68933dc2557a60d67c
SHA2566c9c90057fdfc01b2bf257ce8763bd380f9abee362f8f60b51e309bfab4a4e2e
SHA512c10eab3ad1a38da30ba02e3ac12fe16ef87e87000a92a551cb5dba74404125f06e5fa1935a525b21111253341e8892abe708b0e708b5039e1fb9f46bb4680a1a
-
Filesize
303KB
MD5dca0c059061d95d1bcfc71100d3b35e2
SHA12ad6a1c611bd28b08e1f4a68933dc2557a60d67c
SHA2566c9c90057fdfc01b2bf257ce8763bd380f9abee362f8f60b51e309bfab4a4e2e
SHA512c10eab3ad1a38da30ba02e3ac12fe16ef87e87000a92a551cb5dba74404125f06e5fa1935a525b21111253341e8892abe708b0e708b5039e1fb9f46bb4680a1a