Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2022, 01:38

General

  • Target

    9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe

  • Size

    350KB

  • MD5

    01fe1c04bcc2ca15d32bffa0158f9b20

  • SHA1

    e6ad82b5e6bc08bcf328cb148d10da88ad0055f2

  • SHA256

    9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e

  • SHA512

    a230cc17da8d7fc188a9af871390c9220d2d7924d2e9feb20d784b573fb84a7674984ce96d24975fe3f560ed481b00ff1a7307cec03aabe8c061cc9cd876df6d

  • SSDEEP

    6144:s7Yn9jgZngovqAHaxOp6W6teumW+XGccIuZENT3rdp3N:skpgZ7vwxH/PmDXkIhp3

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3408
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3328
      • C:\Windows\system32\backgroundTaskHost.exe
        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
        1⤵
          PID:3088
        • C:\Windows\system32\backgroundTaskHost.exe
          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
          1⤵
            PID:2560
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
              PID:4716
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
                PID:3648
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3496
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                  1⤵
                    PID:3236
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                    1⤵
                      PID:2632
                    • C:\Windows\Explorer.EXE
                      C:\Windows\Explorer.EXE
                      1⤵
                        PID:3068
                        • C:\Users\Admin\AppData\Local\Temp\9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe
                          "C:\Users\Admin\AppData\Local\Temp\9c961eb89e4c8ca9c44651dbf635dff7b62adb03c8483fe26e3bcfd5598bb57e.exe"
                          2⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:372
                          • C:\Users\Admin\AppData\Roaming\Niyfa\etjao.exe
                            "C:\Users\Admin\AppData\Roaming\Niyfa\etjao.exe"
                            3⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:396
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcd73b46b.bat"
                            3⤵
                              PID:1404
                        • C:\Windows\system32\taskhostw.exe
                          taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                          1⤵
                            PID:2396
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                            1⤵
                              PID:2340
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                                PID:2312
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:1704
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  1⤵
                                    PID:1108
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                    1⤵
                                      PID:516
                                    • C:\Windows\system32\backgroundTaskHost.exe
                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                      1⤵
                                        PID:1528

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\tmpcd73b46b.bat

                                        Filesize

                                        307B

                                        MD5

                                        ef306505d555a697dbe6a8f66b674d21

                                        SHA1

                                        9a1d04b84671eca12cbfc9e8b36de46bc9f00b3c

                                        SHA256

                                        7dee401e29f416853a222da552bc10cd879a193510ed8096c9f31985c496dcdd

                                        SHA512

                                        7440def0be1b3c5e0a4ae90a6471931136628bd1dfe8ec789394e63a4efe5bedf6a196f0d31d3da012abc97b37443a8dc4f97f966e189488be863e743c8b8723

                                      • C:\Users\Admin\AppData\Roaming\Niyfa\etjao.exe

                                        Filesize

                                        350KB

                                        MD5

                                        9e8999fa5363302a86eb4a8df4baff46

                                        SHA1

                                        5319b8879f46c44d35f842fd9b382f4dd33651c1

                                        SHA256

                                        0e044882892fe4231ac6958792f9af5f5f3649bece6871522339016954629521

                                        SHA512

                                        5e424bbec4907b3c363920333efff327fbb464c531bdf0c61aaa1762cca02fdde3378d9b891de86b4e7778f4aec27d93e4a8b27bc881ed095505630d26ae73df

                                      • C:\Users\Admin\AppData\Roaming\Niyfa\etjao.exe

                                        Filesize

                                        350KB

                                        MD5

                                        9e8999fa5363302a86eb4a8df4baff46

                                        SHA1

                                        5319b8879f46c44d35f842fd9b382f4dd33651c1

                                        SHA256

                                        0e044882892fe4231ac6958792f9af5f5f3649bece6871522339016954629521

                                        SHA512

                                        5e424bbec4907b3c363920333efff327fbb464c531bdf0c61aaa1762cca02fdde3378d9b891de86b4e7778f4aec27d93e4a8b27bc881ed095505630d26ae73df

                                      • memory/372-147-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/372-145-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/372-138-0x0000000000400000-0x0000000000447000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/372-137-0x0000000000400000-0x000000000045B000-memory.dmp

                                        Filesize

                                        364KB

                                      • memory/372-142-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/372-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/372-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/372-151-0x00000000022B0000-0x00000000022F7000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/372-146-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/372-136-0x0000000000400000-0x0000000000447000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/372-150-0x0000000000400000-0x0000000000447000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/372-135-0x00000000021C0000-0x0000000002207000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/396-163-0x0000000000400000-0x000000000045B000-memory.dmp

                                        Filesize

                                        364KB

                                      • memory/396-162-0x0000000000400000-0x000000000045B000-memory.dmp

                                        Filesize

                                        364KB

                                      • memory/396-161-0x0000000001F50000-0x0000000001F97000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/1404-149-0x0000000001360000-0x00000000013A7000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/1404-156-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1404-155-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1404-157-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1404-158-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1404-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1404-160-0x0000000001360000-0x00000000013A7000-memory.dmp

                                        Filesize

                                        284KB

                                      • memory/1404-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/1404-152-0x000000006FFF0000-0x0000000070000000-memory.dmp

                                        Filesize

                                        64KB