Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    173s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 23:53

General

  • Target

    c15176343ed7377da190b57d2336b37dd7afff427c1b82a33393c38e255247c0.exe

  • Size

    152KB

  • MD5

    93eea248e005c2710c46a514cd81b736

  • SHA1

    0d4cdb6988a4895213045a760ddd0e9d9279ef2c

  • SHA256

    c15176343ed7377da190b57d2336b37dd7afff427c1b82a33393c38e255247c0

  • SHA512

    2517a58a5484c6a0a5af57354d1be79b66e57ba518b7d05090395d3f59fd65fdeb0d7470eadad61ec82dfd71d46151948c5469d0f538de55591f6b83cc3db863

  • SSDEEP

    3072:t5gFJ520XP84d6sGh+qo9CNNsPi391VzIxnY56zF/QDI:toJ5hPBu0qcCNG637VOYy

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c15176343ed7377da190b57d2336b37dd7afff427c1b82a33393c38e255247c0.exe
    "C:\Users\Admin\AppData\Local\Temp\c15176343ed7377da190b57d2336b37dd7afff427c1b82a33393c38e255247c0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\c15176343ed7377da190b57d2336b37dd7afff427c1b82a33393c38e255247c0.exe
      "C:\Users\Admin\AppData\Local\Temp\c15176343ed7377da190b57d2336b37dd7afff427c1b82a33393c38e255247c0.exe"
      2⤵
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VHIFO.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "skypee" /t REG_SZ /d "C:\Windows\Skypee\skypee.exe" /f
          4⤵
          • Adds Run key to start application
          PID:2016
      • C:\Windows\Skypee\skypee.exe
        "C:\Windows\Skypee\skypee.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Windows\Skypee\skypee.exe
          "C:\Windows\Skypee\skypee.exe"
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1920
        • C:\Windows\Skypee\skypee.exe
          "C:\Windows\Skypee\skypee.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:588
  • C:\Windows\SysWOW64\monilor.exe
    C:\Windows\SysWOW64\monilor.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Windows\SysWOW64\monilor.exe
      "C:\Windows\SysWOW64\monilor.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Windows\TEMP\WTCCN.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "skypee" /t REG_SZ /d "C:\Windows\Skypee\skypee.exe" /f
          4⤵
          • Modifies data under HKEY_USERS
          PID:564
      • C:\Windows\Skypee\skypee.exe
        "C:\Windows\Skypee\skypee.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Windows\Skypee\skypee.exe
          "C:\Windows\Skypee\skypee.exe"
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1688
        • C:\Windows\Skypee\skypee.exe
          "C:\Windows\Skypee\skypee.exe"
          4⤵
          • Executes dropped EXE
          PID:1640

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\VHIFO.bat

    Filesize

    121B

    MD5

    6f03830aff31995957052b694b2211a0

    SHA1

    bc98df25a4accd29643b311c106e1cdcecdec93c

    SHA256

    7ddb76d54b187f9e03639ee200536062c36abea7f2fb073ca9bccfb5acc55934

    SHA512

    f02357a8148e3f0c2e3f8f44c317c94450cbda8acd1890369ad91cd1c140089bfbfd6659702f79761e49b8b665f37667d806ccaed416c6de43e1a99d07a69175

  • C:\Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\SysWOW64\monilor.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\SysWOW64\monilor.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\SysWOW64\monilor.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • C:\Windows\TEMP\WTCCN.bat

    Filesize

    121B

    MD5

    6f03830aff31995957052b694b2211a0

    SHA1

    bc98df25a4accd29643b311c106e1cdcecdec93c

    SHA256

    7ddb76d54b187f9e03639ee200536062c36abea7f2fb073ca9bccfb5acc55934

    SHA512

    f02357a8148e3f0c2e3f8f44c317c94450cbda8acd1890369ad91cd1c140089bfbfd6659702f79761e49b8b665f37667d806ccaed416c6de43e1a99d07a69175

  • \Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • \Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • \Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • \Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • \Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • \Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • \Windows\Skypee\skypee.exe

    Filesize

    152KB

    MD5

    38adeb9eb05c36d0de3ea912e76d5b56

    SHA1

    9a2b2625ced7ddff59121d8684a8ee2e0bcfd1e2

    SHA256

    5e8c023661f37c9aded5df71bfc45a39e262ac9fbfa74b28dc723a8668cfa1fe

    SHA512

    8192329b749abf1824854adbdc7c3b39d9edff73aca4dd3cba35e0091524f4e8c81f46beca8518e488705c5f83d2d43d31ba69d5723cef6ed2acdabadcc27aab

  • memory/588-104-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-88-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-90-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-94-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-95-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-120-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-100-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-106-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/588-105-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1220-157-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1220-125-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-64-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-60-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-59-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-57-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-67-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-56-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-98-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1536-68-0x0000000075131000-0x0000000075133000-memory.dmp

    Filesize

    8KB

  • memory/1536-63-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1640-160-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1640-161-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1688-162-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1688-165-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1920-103-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1920-164-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB