Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe
Resource
win10v2004-20220812-en
General
-
Target
96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe
-
Size
109KB
-
MD5
91bdfdea01264c64ef11b04ea11487e0
-
SHA1
b473dddfe57f513c296b31ac435e63c1a2d8055b
-
SHA256
96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e
-
SHA512
ff2a66fb40f51b6cc3348dd4a00db9aadc80aca76452eba556b8e564d6a1c3a644c907375b3c7460aae1ad3032f830a5a6d132286d384d487d2de09bcf1d0a6d
-
SSDEEP
1536:ObAmatlbHUZU/lL0w07s/4TbgvHktE3nkGxPbodJL96HZ2QxOyY:ObAmatlYZJw01bMFw0Z2COV
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2036 umbunmhkuf.pre 1988 umbunmhkuf.pre -
resource yara_rule behavioral1/memory/1456-58-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1456-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1456-55-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1456-62-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1456-61-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1456-66-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1988-87-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1184 ctfmon.exe -
Loads dropped DLL 3 IoCs
pid Process 1184 ctfmon.exe 1184 ctfmon.exe 2036 umbunmhkuf.pre -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mytbyxyz = "C:\\Users\\Admin\\Hboffvre\\yfjkkthyxyz.exe" explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 904 set thread context of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 2036 set thread context of 1988 2036 umbunmhkuf.pre 30 -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 904 wrote to memory of 1456 904 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 27 PID 1456 wrote to memory of 1184 1456 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 28 PID 1456 wrote to memory of 1184 1456 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 28 PID 1456 wrote to memory of 1184 1456 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 28 PID 1456 wrote to memory of 1184 1456 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 28 PID 1456 wrote to memory of 1184 1456 96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe 28 PID 1184 wrote to memory of 2036 1184 ctfmon.exe 29 PID 1184 wrote to memory of 2036 1184 ctfmon.exe 29 PID 1184 wrote to memory of 2036 1184 ctfmon.exe 29 PID 1184 wrote to memory of 2036 1184 ctfmon.exe 29 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 2036 wrote to memory of 1988 2036 umbunmhkuf.pre 30 PID 1988 wrote to memory of 1212 1988 umbunmhkuf.pre 31 PID 1988 wrote to memory of 1212 1988 umbunmhkuf.pre 31 PID 1988 wrote to memory of 1212 1988 umbunmhkuf.pre 31 PID 1988 wrote to memory of 1212 1988 umbunmhkuf.pre 31 PID 1988 wrote to memory of 1212 1988 umbunmhkuf.pre 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe"C:\Users\Admin\AppData\Local\Temp\96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe"C:\Users\Admin\AppData\Local\Temp\96319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\umbunmhkuf.preC:\Users\Admin\AppData\Local\Temp\umbunmhkuf.pre4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\umbunmhkuf.preC:\Users\Admin\AppData\Local\Temp\umbunmhkuf.pre5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe6⤵
- Adds Run key to start application
PID:1212
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD591bdfdea01264c64ef11b04ea11487e0
SHA1b473dddfe57f513c296b31ac435e63c1a2d8055b
SHA25696319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e
SHA512ff2a66fb40f51b6cc3348dd4a00db9aadc80aca76452eba556b8e564d6a1c3a644c907375b3c7460aae1ad3032f830a5a6d132286d384d487d2de09bcf1d0a6d
-
Filesize
109KB
MD591bdfdea01264c64ef11b04ea11487e0
SHA1b473dddfe57f513c296b31ac435e63c1a2d8055b
SHA25696319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e
SHA512ff2a66fb40f51b6cc3348dd4a00db9aadc80aca76452eba556b8e564d6a1c3a644c907375b3c7460aae1ad3032f830a5a6d132286d384d487d2de09bcf1d0a6d
-
Filesize
109KB
MD591bdfdea01264c64ef11b04ea11487e0
SHA1b473dddfe57f513c296b31ac435e63c1a2d8055b
SHA25696319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e
SHA512ff2a66fb40f51b6cc3348dd4a00db9aadc80aca76452eba556b8e564d6a1c3a644c907375b3c7460aae1ad3032f830a5a6d132286d384d487d2de09bcf1d0a6d
-
Filesize
109KB
MD591bdfdea01264c64ef11b04ea11487e0
SHA1b473dddfe57f513c296b31ac435e63c1a2d8055b
SHA25696319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e
SHA512ff2a66fb40f51b6cc3348dd4a00db9aadc80aca76452eba556b8e564d6a1c3a644c907375b3c7460aae1ad3032f830a5a6d132286d384d487d2de09bcf1d0a6d
-
Filesize
109KB
MD591bdfdea01264c64ef11b04ea11487e0
SHA1b473dddfe57f513c296b31ac435e63c1a2d8055b
SHA25696319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e
SHA512ff2a66fb40f51b6cc3348dd4a00db9aadc80aca76452eba556b8e564d6a1c3a644c907375b3c7460aae1ad3032f830a5a6d132286d384d487d2de09bcf1d0a6d
-
Filesize
109KB
MD591bdfdea01264c64ef11b04ea11487e0
SHA1b473dddfe57f513c296b31ac435e63c1a2d8055b
SHA25696319c25b90c8aafa3ad41b598870c46b38dedcb2eb41b1921c84d830db0419e
SHA512ff2a66fb40f51b6cc3348dd4a00db9aadc80aca76452eba556b8e564d6a1c3a644c907375b3c7460aae1ad3032f830a5a6d132286d384d487d2de09bcf1d0a6d