Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe
Resource
win10v2004-20220901-en
General
-
Target
9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe
-
Size
350KB
-
MD5
01fe1c04bcc2ca15d32bffa0158f9b20
-
SHA1
e6ad82b5e6bc08bcf328cb148d10da88ad0055f2
-
SHA256
9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e
-
SHA512
a230cc17da8d7fc188a9af871390c9220d2d7924d2e9feb20d784b573fb84a7674984ce96d24975fe3f560ed481b00ff1a7307cec03aabe8c061cc9cd876df6d
-
SSDEEP
6144:s7Yn9jgZngovqAHaxOp6W6teumW+XGccIuZENT3rdp3N:skpgZ7vwxH/PmDXkIhp3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 396 etjao.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run etjao.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{32C81FC9-556D-BCA0-B82C-F77E75D9ED7C} = "C:\\Users\\Admin\\AppData\\Roaming\\Niyfa\\etjao.exe" etjao.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 372 set thread context of 1404 372 9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe 84 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe 396 etjao.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 396 372 9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe 83 PID 372 wrote to memory of 396 372 9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe 83 PID 372 wrote to memory of 396 372 9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe 83 PID 396 wrote to memory of 2312 396 etjao.exe 48 PID 396 wrote to memory of 2312 396 etjao.exe 48 PID 396 wrote to memory of 2312 396 etjao.exe 48 PID 396 wrote to memory of 2312 396 etjao.exe 48 PID 396 wrote to memory of 2312 396 etjao.exe 48 PID 396 wrote to memory of 2340 396 etjao.exe 47 PID 396 wrote to memory of 2340 396 etjao.exe 47 PID 396 wrote to memory of 2340 396 etjao.exe 47 PID 396 wrote to memory of 2340 396 etjao.exe 47 PID 396 wrote to memory of 2340 396 etjao.exe 47 PID 396 wrote to memory of 2396 396 etjao.exe 46 PID 396 wrote to memory of 2396 396 etjao.exe 46 PID 396 wrote to memory of 2396 396 etjao.exe 46 PID 396 wrote to memory of 2396 396 etjao.exe 46 PID 396 wrote to memory of 2396 396 etjao.exe 46 PID 396 wrote to memory of 3068 396 etjao.exe 37 PID 396 wrote to memory of 3068 396 etjao.exe 37 PID 396 wrote to memory of 3068 396 etjao.exe 37 PID 396 wrote to memory of 3068 396 etjao.exe 37 PID 396 wrote to memory of 3068 396 etjao.exe 37 PID 396 wrote to memory of 2632 396 etjao.exe 36 PID 396 wrote to memory of 2632 396 etjao.exe 36 PID 396 wrote to memory of 2632 396 etjao.exe 36 PID 396 wrote to memory of 2632 396 etjao.exe 36 PID 396 wrote to memory of 2632 396 etjao.exe 36 PID 396 wrote to memory of 3236 396 etjao.exe 35 PID 396 wrote to memory of 3236 396 etjao.exe 35 PID 396 wrote to memory of 3236 396 etjao.exe 35 PID 396 wrote to memory of 3236 396 etjao.exe 35 PID 396 wrote to memory of 3236 396 etjao.exe 35 PID 396 wrote to memory of 3328 396 etjao.exe 11 PID 396 wrote to memory of 3328 396 etjao.exe 11 PID 396 wrote to memory of 3328 396 etjao.exe 11 PID 396 wrote to memory of 3328 396 etjao.exe 11 PID 396 wrote to memory of 3328 396 etjao.exe 11 PID 396 wrote to memory of 3408 396 etjao.exe 10 PID 396 wrote to memory of 3408 396 etjao.exe 10 PID 396 wrote to memory of 3408 396 etjao.exe 10 PID 396 wrote to memory of 3408 396 etjao.exe 10 PID 396 wrote to memory of 3408 396 etjao.exe 10 PID 396 wrote to memory of 3496 396 etjao.exe 34 PID 396 wrote to memory of 3496 396 etjao.exe 34 PID 396 wrote to memory of 3496 396 etjao.exe 34 PID 396 wrote to memory of 3496 396 etjao.exe 34 PID 396 wrote to memory of 3496 396 etjao.exe 34 PID 396 wrote to memory of 3648 396 etjao.exe 33 PID 396 wrote to memory of 3648 396 etjao.exe 33 PID 396 wrote to memory of 3648 396 etjao.exe 33 PID 396 wrote to memory of 3648 396 etjao.exe 33 PID 396 wrote to memory of 3648 396 etjao.exe 33 PID 396 wrote to memory of 4716 396 etjao.exe 30 PID 396 wrote to memory of 4716 396 etjao.exe 30 PID 396 wrote to memory of 4716 396 etjao.exe 30 PID 396 wrote to memory of 4716 396 etjao.exe 30 PID 396 wrote to memory of 4716 396 etjao.exe 30 PID 396 wrote to memory of 2560 396 etjao.exe 13 PID 396 wrote to memory of 2560 396 etjao.exe 13 PID 396 wrote to memory of 2560 396 etjao.exe 13 PID 396 wrote to memory of 2560 396 etjao.exe 13 PID 396 wrote to memory of 2560 396 etjao.exe 13 PID 396 wrote to memory of 3088 396 etjao.exe 12
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3408
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3328
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3088
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2560
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4716
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3648
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3496
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2632
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe"C:\Users\Admin\AppData\Local\Temp\9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Roaming\Niyfa\etjao.exe"C:\Users\Admin\AppData\Roaming\Niyfa\etjao.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcd73b46b.bat"3⤵PID:1404
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2340
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2312
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1704
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1108
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:516
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1528
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD5ef306505d555a697dbe6a8f66b674d21
SHA19a1d04b84671eca12cbfc9e8b36de46bc9f00b3c
SHA2567dee401e29f416853a222da552bc10cd879a193510ed8096c9f31985c496dcdd
SHA5127440def0be1b3c5e0a4ae90a6471931136628bd1dfe8ec789394e63a4efe5bedf6a196f0d31d3da012abc97b37443a8dc4f97f966e189488be863e743c8b8723
-
Filesize
350KB
MD59e8999fa5363302a86eb4a8df4baff46
SHA15319b8879f46c44d35f842fd9b382f4dd33651c1
SHA2560e044882892fe4231ac6958792f9af5f5f3649bece6871522339016954629521
SHA5125e424bbec4907b3c363920333efff327fbb464c531bdf0c61aaa1762cca02fdde3378d9b891de86b4e7778f4aec27d93e4a8b27bc881ed095505630d26ae73df
-
Filesize
350KB
MD59e8999fa5363302a86eb4a8df4baff46
SHA15319b8879f46c44d35f842fd9b382f4dd33651c1
SHA2560e044882892fe4231ac6958792f9af5f5f3649bece6871522339016954629521
SHA5125e424bbec4907b3c363920333efff327fbb464c531bdf0c61aaa1762cca02fdde3378d9b891de86b4e7778f4aec27d93e4a8b27bc881ed095505630d26ae73df