Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1158s -
max time network
1161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26/10/2022, 22:52
Errors
General
-
Target
https://github.com/Endermanch/MalwareDatabase/raw/master/enderware/Koteyka2.zip
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Kills process with taskkill 3 IoCs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 30 IoCs
-
Modifies registry class 48 IoCs
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/raw/master/enderware/Koteyka2.zip1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\[email protected]"C:\Users\Admin\Desktop\[email protected]"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\[email protected]"C:\Users\Admin\Desktop\[email protected]"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\[email protected]
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /im Kotekya.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /im koteyka2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /im koteyka.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340B
MD57b7d53f1ade2e99fbec77e6376257999
SHA1e914a0efdd5f421e895f3617df4d749cca5450c0
SHA256dc36eb90df26adff83dc65ed4ecab9f07adacdda0370d0db3e694e28b1b92564
SHA5128b5a854b89ec3474ba0b3cbc687d5959e4098038fc86aefc83af5bdbdb4d40c4a082544e473a281a3c81d0c625f7593d6e5a2ba681154972e0154f4b6cf30fc4
-
Filesize
608B
MD5eda4243bf950af34e09aeeb17875d4ce
SHA1e47de100495c24277baec287d3548ad02e1bbbd5
SHA25630bab20c23f165e02391815e23bac99c6c475a6485608e6d4766603578032538
SHA5123d1acedec1cc2ad2248995911404672f26325761b83034dcaf071245248c8a4115ef522310b4d3db84c6599c3e5970027ff19f809851f0a7b8a022c93ab1d2f8
-
Filesize
792KB
MD55dd134de06bcea121498ffebd8c3b5cf
SHA12af26ef9de66718a31f2acc2b5a86c2887c2bcb4
SHA256747392e78896f6c3eb229ff4aa02c6b1401f7ca99a66534beec8dc3e79af24ee
SHA5126a8c5371b1a2bc19a793da6de98a1f8d4ed28707d42d91d2b9b22c8ebd1cfb6ac5a14bf63a9dccbbf6faacf51502b43098dd8e8568646f471b2250b822b6f789
-
Filesize
817KB
MD569ea1eca5bf13fd3ad77dbd2c46ca0a4
SHA16cc9937718f7be7024acb01b13de416c9a5c2807
SHA256eec822b095f59b1a17b9220185e790939c9ce31b519b7200a6f0d3dee98b870f
SHA51253c1aa7a3551363cc4c0518bff2c825c4d4d080faf020ac91ad53ced22834c5727fe1b202d5a8b44f1ba3a99664db47fd9c3fccffddcda64b2c5e6a568bbb5c9
-
Filesize
364KB
MD547cad73bf62cf035c42caed204ab344f
SHA165352d9d7291d9763793cc9db118af60d120d7cc
SHA256acd7fee70ab4d8a2c76f6efc04b3c768f9358eda366ef96d21cd82605f5e20b7
SHA512c273811b6f0d2891a98f595fe22599a6f7b6347897dbbe5b246cb68b2b09a598ab131875414634b14eab9f86812ed27f669c91e358abdaee16ab5cf5e47c10c8
-
Filesize
314KB
MD5a710ff1375dedee250e6bd34ea32cbd5
SHA14df71a78262e7b4df70934057be9e965b97cd063
SHA25672ee15bdfa6dcd81b3dc97f8f34e290ec83bb8276705e1fad60b5130458db191
SHA512bbe7d1592012bb5a2701a748688b78068fe1e05a71f1c0a9fec08383d0331f21c21620fad7bd44f2c74d35cd6f6eb404adc109b9e59e42180a8c933b4be19c04
-
Filesize
415KB
MD5ecf3df6b5722c8ea0e4a08c1836dd020
SHA1437f8729790a3271840377b9b78daff9db9a86b1
SHA256a78b554bed23f49dddfd6e7da2d0b982cb19f2c9f7278e05c8c2560e5756a377
SHA5125216bced7d5596183657e25ad96d6fe2ff8d35e416aff5630889ff09b58689975d89fb4fb681c2528da864efe912cee00033d09355737d2139c68cbf1dc4e9fe
-
Filesize
767KB
MD5e882d9210fa21e503bd0358cf3394c0c
SHA1e13cf41dea6095be6ccbb595202d6a3b939ae2e1
SHA2562bca673cec862a4d72aa89c7ee639925d2a041305c328a4b164cebe6b55fbd9f
SHA512a5c1d023441ea3f0915b0c8e1b21b48faa0786d4de5c55fd75291a8d627ce383cb5837cb0900666ddfb6fa2e7961e2218fd40f1f627ccb4084075820c69abe69
-
Filesize
490KB
MD5492b06cb520af5f672c7f1dd72ed6f50
SHA19d759db85fbaa65c3162e115445d3e9bdbd6a496
SHA256456969bceb8a48576d914d285836676fa6e4ed1f05461391233074b162d3dea3
SHA51201f200783253493ae01d93975d22b5d83c172f9e2db661a1e2bc1beeaef51a72c3634b3b782d9bca8e82bf5e14aa48ce7b2f6f77a930f4a4a65e16a4147910ee
-
Filesize
641KB
MD54f119b257df5fc4c9cc5e7cd24996076
SHA113c440735c3c1a07abe8e41d60fed5326070fe32
SHA256361b5d1eaa62e585e2b90ff2fbbf3b495955b5604e65e1eeef3ddf4bf2c80d20
SHA5123558ae8884fbc1f8963ec141233d0ba7091ec2ee7c5d8941a19fcfa152f808947c8ec9576f5bd7e805e7df73bde1298df9da5922422780507371e8824798f34b
-
Filesize
339KB
MD546d0db0a88ddb5b4b27e04541e41ef58
SHA168bcc2634497facda3007ed33d4f034d4a1f25a9
SHA2566421f1c120bcad35c505d17cf4cdfbb04c012042d5a964044394a7845be06e3f
SHA512c9e2fff8f4f9a9864e172c5b6f88275c9ec1d7b42cf84fe5f5a1d2bc653ab9a333a526a4fc505943ffa7e93cef7c4e28729c1585928ccbe97f361d33f1bee57c
-
Filesize
666KB
MD58c64067a9748740a2d892e17fd41c4af
SHA1d91d34374e6a2f1b94a184dfb7122afb05f4e496
SHA25693b08e55e7f25ac40d1eae5d9a7eeb4c8c45cede29d6f12983babd96daf93a52
SHA5125be63fc4da7689095def9903c8cd0b1d64cf0db76bf1ff05f57280dd445f1c890803e56fca0ae953fef4ff2d56cf931666280b517dc406bad7cb0699d42a7969
-
Filesize
742KB
MD5e593729591272351627690ec1b211bc6
SHA17ee9a66f3f3dd57eb7b2239c0fa7dbd5e3d62654
SHA2563de0ffa471ba76f8c509569ba4ab08e835f6f36bf69b5c5e315fba02efcff3f9
SHA512110ecedf6a72081ed5c78c7dc7dcb85679817f4483b6d990d3efdbfe7162c1df35e639c728f86f8dda8b1c41ac5c646286267afc7636c333b9d20837be20006d
-
Filesize
616KB
MD568e91a3c494ce7e23824fd1b97704dbf
SHA1f80a568337239ad7312eb2351b5595e57ab385da
SHA256f8fe090e9873b19de265397263c84885d426dca561863c48f9a41886bc90dbb7
SHA51217c20d67fa36012723ddbf63c77964e2be8f02b5fbd0cd36496bc92e36821c59fd24ed5c8ef4091c252a42e023b5776f2cdb91d867dd3ede7c7ac05633a51a1b
-
Filesize
721KB
MD50b6957df7b5112415195636db7c6b69f
SHA11d539b1533b5e5f56723a1e3f256325f095e3ab3
SHA256b5d89cd72f3ded5ee31a61775738c3881eb8984f37a265056055755847817785
SHA512aa6378c8a76df76a8a0bfa90fc5bc7b3d00762af720f85016119b11cca9882c4c9e7eb2e9af2210fc8129c18e16b34ba65b8e0718b17d928dbcbec698ad6434e
-
Filesize
721KB
MD50b6957df7b5112415195636db7c6b69f
SHA11d539b1533b5e5f56723a1e3f256325f095e3ab3
SHA256b5d89cd72f3ded5ee31a61775738c3881eb8984f37a265056055755847817785
SHA512aa6378c8a76df76a8a0bfa90fc5bc7b3d00762af720f85016119b11cca9882c4c9e7eb2e9af2210fc8129c18e16b34ba65b8e0718b17d928dbcbec698ad6434e
-
Filesize
591KB
MD5a7af338d8e3ba34cff7f0ffe9d6f6586
SHA1a8398749685e782e685ce92d0c177f182a3a520a
SHA2569e0c55d440f5382681c7a147bd68b71c6068fde5103d2d7b724bfb8d14197e1b
SHA5122b12c4ac923cb9661774dd093d35d06b19610ca0ec132d32047f949ee8a11c789b4640fa17c9d03edfae218295539341d695a4df8b2cbc2544fdeb49170ec6d4
-
Filesize
390KB
MD5ac149f46975dcffc987d9d4924e91303
SHA14704802d7b81adb4e477022c89ae613f36ff8f71
SHA2565b1d54439219cb60900b61805398d20130cadd512fd2670e0a9beb2077420a41
SHA51229bfb29d7778cb8b5f11ca87ce8bff37f47e307b1006f4d7060106922777fa94e1cabb64d050f55c9fcd67b2b5ef7e925fdbebd33b821ae5c4c0447ed123d6e7
-
Filesize
515KB
MD58be3abafea82c9d358fc08f482680a52
SHA110419794d07856eb5b9831807c054e2c277e39a9
SHA2569ca2a4e85d96d39718f1c4eaa540e47ed3a6df6ce36b221c7eeffe376c31e0f2
SHA5121c444bc89e556575a7e294edf9238346b3c12a17451cfab80d4705ac201e8840da80854116a77624280db9ce573f31f788b85cf7707d52621dcf34dcc79d3cd4
-
Filesize
566KB
MD5b7b15468613f313d4247659ea7e2190b
SHA1121c5924fcbc25379aafb1c3ef2b8fdecd7b850a
SHA2566f6a965a46e75e00875389eb3dea8ae307ad08d669090c16286534253b546698
SHA5123ca793e504bc9575f69cc34313a18ddb3b140703cb849ca2ec46072de92825e0dc10a61239402c44ccbc0541e2db900400c0344b4b584db35a1f3403c091bbac
-
Filesize
289KB
MD5c0b023683c4db7ce0717e3eba1ef0bb2
SHA1a2d91382bb5f212edd6e37cd59820b20b956fba4
SHA2568126d00d18dddfa977ddf832410638601f254b8178021ab60585fe6ac0b0e2bf
SHA512062079905ec77ffbcf238e2c88145d17393565e4c2cd606a25fb304657373117edcf06bb0ef479ff87a641c01347058ec20dc38a2a8a7e815a772d5d542b7d23
-
Filesize
1.1MB
MD529eb51364f4e58010a654ea83ad5f871
SHA1cfbfd15bf0ba55d50202451d852cbd817c697b46
SHA2560ffe498ebfb3d3e198b6354aaa57e7b797dbf7d546644204809d3f27264d3117
SHA5120a7ccf9cf4aab766ce8ac9a5484bf8fe02330f35c7097c7041ab590b81e4ef78b44aac28ba7585cf091384bcbaae08ee3d8d4957d77d821de485dc64086aa0c4
-
Filesize
465KB
MD559997e8664e0195ff8d4001eecd8818f
SHA1df3e10299102bacdf6f3066e063ebceca07d3736
SHA256caf2edf4c47175d19cb95f4c58300a2ef1347e37e59e31fa94b5c5fe2a217f1d
SHA51232b92fecb02f51948e4111ff16959b2eec88bf29cddea37d2334252ce3934f9a601cb07e80cac15dd3e63437138065124d9c353b9afe1976657b95616bf703ed
-
Filesize
692KB
MD560e86eaa038d35c100e1664bb94fc546
SHA17c0d48f1f15aded9b0a7bb4b1abd4faca551a239
SHA256b563d85a1b4083fc9089a5978f4aff3536f9c8f8c63438d51c702602476227f8
SHA5126b1087d87eff043d92a5c4b8db3f34cb85569a141d7e305f0ccfeb443b451ba145a5919ad59aaa2f19708a2fb1a834849650bb9214399fc84daf0e79fd94c259
-
Filesize
541KB
MD552637771cd70d0f5fbd694f397edc635
SHA19d5c29e0e6c9ccf34fcb4c1936fe68db44215311
SHA2567517f983a2807a2fc127620edfdc4661a48fa00847e2944f54af6b706d303e4b
SHA5126fefa0b3b1d30beea83e709f08094b8ac34cfc2d1a6f65f4f35757a9509df1ce40e0d5b7e91107d048bd298235e5c4459ddf6ff3484f45e7cf6befeb85cb08e1
-
Filesize
440KB
MD566e3a0e58ce9b85709fcbd8fbe3c1085
SHA10b86f4191e246e40257fda9649a86247d9fe6375
SHA256f770a97d008496924c1cbd11b599879b15f000834fede3b511c699322b9d25a1
SHA5121dd52900e2deafdf9ebb1f355fd0775c5810452693deb3aee020ddc4f770d9b23e2f21b7fd3a58e2911920ac5fcd215a63a5c867eb1a8c97edac33c012d17901
-
Filesize
717KB
MD588b6002686ee7d7a1a190d6376d84622
SHA1d892989458485489d5488ac25f6c0848c4373406
SHA25619d06dc7f50151d5d6baaf3dc61e52e719da98bb2ae13adee0e8e429e62bb66e
SHA5127d7d4ec9ca8097713d00920a737296d3ac22f07b800e6e4db040fe5adcf165ed5df57347028820697a8016582aa695c81f32f33b3f29b56a98d022f10f099fb5
-
Filesize
1KB
MD522260c6c949270d1b0d3a1187eeaf06e
SHA108d26f319cb75b6c97a35dd058361cc376d6facc
SHA25663b70d30c3a5457a32b3c175b08fa88322627f498c216ac94f5121245c0504b1
SHA512a42317cb555ba7d3b013b597cdc051c32a7e53a07103bd3b6afa9b04c5eb71a01ff0adf782c9ca6c2600571cf09291bda669360c702b38a1edd6b919c140f9a7
-
Filesize
931B
MD5970d8953f5bc8d759741b5263c73f888
SHA1f1a6408c02e83a977467ad84a6566629a98a58a8
SHA2562b1ac23d14aad8d6f9fcb55ddd4405c68d4ad8d83214e7ef36ed1c9ccdab2eef
SHA5123c5bcad10882ade665af9225370ecbf966df5f6eae593d909e4f0a76025522dca00de3ffef692f977b7c0a76582200128112aff0e80b02946aa92db74e581404
-
Filesize
2KB
MD5a6fb2c2f1fd4fe0c265e04cd22d383a3
SHA17e2f1a19f16f7459da36a07215c4132d94d9a720
SHA2564d81ddbdd25f8cf4d512d15ba7ccb942b060a3c608271c17268dbf59ccfad424
SHA51264d562f1657c21446cd04aa65e9aaa0a26518a26a9dfa8aec19094fa8c6c815d0c73e7059d33c6de88244cb6c62be6bcb6bb9c779ce5ca8e835116e50fdaf801
-
Filesize
878B
MD55d4290a862712105b5769badae840584
SHA180ea05b2c2cf5d272a598c08a7e70b1e8652d9bf
SHA2566cc2c98598069cdc28652e9634cbf6460f9d9dd8635251fb72ea1162ae88f5af
SHA512b96013a30ede31a80f18044cafc79b9ab56cfbc1232f78583f02f9a43919bf27f8a279873c31f53aa8fd6036b66688a25ec241a680e2351d0ceae9ee8a6e568a
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
8KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
8KB
