Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 02:27
Behavioral task
behavioral1
Sample
e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe
Resource
win10v2004-20220901-en
General
-
Target
e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe
-
Size
139KB
-
MD5
725c8f8a33a716a39db6c219b88f9b89
-
SHA1
8db082975d044e979a8cbf3aaead0d07c410b6cc
-
SHA256
e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f
-
SHA512
dab88c76c1cbfa241663ef0da89a4eaf63b8d0ccbd7f5b3eb19553fb6492c2cd456df612b9fa47bb1f69fb5b8262566d754ac2ffe4987b3be4bf0274b4a14137
-
SSDEEP
3072:3pgeClEc0sPDo6tSEwRwErxjqfMj7MTRhzQGys3t/xO+2FxgHUR9T+GRNqHYu:3Oe80s86pMT5qEmRhzQY3p0JSyCT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1112 yqyk.exe -
resource yara_rule behavioral1/files/0x000a0000000133ab-60.dat upx behavioral1/files/0x000a0000000133ab-61.dat upx behavioral1/files/0x000a0000000133ab-63.dat upx behavioral1/files/0x000a0000000133ab-65.dat upx -
Deletes itself 1 IoCs
pid Process 1600 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\Currentversion\Run yqyk.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\{DA38D66A-46B9-5E1B-0C4A-2A423A3DAAC7} = "C:\\Users\\Admin\\AppData\\Roaming\\Ikut\\yqyk.exe" yqyk.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1388 set thread context of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Privacy e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe 1112 yqyk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe Token: SeSecurityPrivilege 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe Token: SeSecurityPrivilege 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1112 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 26 PID 1388 wrote to memory of 1112 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 26 PID 1388 wrote to memory of 1112 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 26 PID 1388 wrote to memory of 1112 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 26 PID 1112 wrote to memory of 1260 1112 yqyk.exe 11 PID 1112 wrote to memory of 1260 1112 yqyk.exe 11 PID 1112 wrote to memory of 1260 1112 yqyk.exe 11 PID 1112 wrote to memory of 1260 1112 yqyk.exe 11 PID 1112 wrote to memory of 1260 1112 yqyk.exe 11 PID 1112 wrote to memory of 1344 1112 yqyk.exe 10 PID 1112 wrote to memory of 1344 1112 yqyk.exe 10 PID 1112 wrote to memory of 1344 1112 yqyk.exe 10 PID 1112 wrote to memory of 1344 1112 yqyk.exe 10 PID 1112 wrote to memory of 1344 1112 yqyk.exe 10 PID 1112 wrote to memory of 1396 1112 yqyk.exe 5 PID 1112 wrote to memory of 1396 1112 yqyk.exe 5 PID 1112 wrote to memory of 1396 1112 yqyk.exe 5 PID 1112 wrote to memory of 1396 1112 yqyk.exe 5 PID 1112 wrote to memory of 1396 1112 yqyk.exe 5 PID 1112 wrote to memory of 1388 1112 yqyk.exe 25 PID 1112 wrote to memory of 1388 1112 yqyk.exe 25 PID 1112 wrote to memory of 1388 1112 yqyk.exe 25 PID 1112 wrote to memory of 1388 1112 yqyk.exe 25 PID 1112 wrote to memory of 1388 1112 yqyk.exe 25 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1388 wrote to memory of 1600 1388 e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe 27 PID 1112 wrote to memory of 924 1112 yqyk.exe 29 PID 1112 wrote to memory of 924 1112 yqyk.exe 29 PID 1112 wrote to memory of 924 1112 yqyk.exe 29 PID 1112 wrote to memory of 924 1112 yqyk.exe 29 PID 1112 wrote to memory of 924 1112 yqyk.exe 29 PID 1112 wrote to memory of 856 1112 yqyk.exe 30 PID 1112 wrote to memory of 856 1112 yqyk.exe 30 PID 1112 wrote to memory of 856 1112 yqyk.exe 30 PID 1112 wrote to memory of 856 1112 yqyk.exe 30 PID 1112 wrote to memory of 856 1112 yqyk.exe 30 PID 1112 wrote to memory of 1812 1112 yqyk.exe 31 PID 1112 wrote to memory of 1812 1112 yqyk.exe 31 PID 1112 wrote to memory of 1812 1112 yqyk.exe 31 PID 1112 wrote to memory of 1812 1112 yqyk.exe 31 PID 1112 wrote to memory of 1812 1112 yqyk.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe"C:\Users\Admin\AppData\Local\Temp\e153b654720dd92a95ec265fa477197f287a65de10b2b3b28a16d5abe8f0806f.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Roaming\Ikut\yqyk.exe"C:\Users\Admin\AppData\Roaming\Ikut\yqyk.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb097b467.bat"3⤵
- Deletes itself
PID:1600
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1344
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1260
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:924
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:856
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD535e1fac2db5ccd2379394d1552e22432
SHA106bd8373ba07f9339dc3b8d0fb53ac6aae11e02b
SHA256c6c9fc1963d7d4c24c5587e5e2760cff5c99c898445b1432f9834e0e8fa6fe26
SHA51298fab514ec2bb2a8b013fad7c210bd1030eab923a6843333a6a521a1b70116d25cf2696af6cbbf8186b85f0d449dcfe8ce72314ce9bdd610bdeaeb777215fb54
-
Filesize
139KB
MD527ee250ccb466c6fda4f5c7ceaa80d3a
SHA126c2b61e0b442e9ca9de0597c3a6f289fb34a8ac
SHA2561e54a55ec1dca45e482e08df908b69cd107d41476d8d9e6c9e12d131a41fcab9
SHA512efac6de96a7189795cc95d34ae535196252b2860622e0235a40187f0f3d7e41d8230a3b2dc84b948d74ac9f92ec3c2e7405280702b1fa74d011cfbd1eef3e95a
-
Filesize
139KB
MD527ee250ccb466c6fda4f5c7ceaa80d3a
SHA126c2b61e0b442e9ca9de0597c3a6f289fb34a8ac
SHA2561e54a55ec1dca45e482e08df908b69cd107d41476d8d9e6c9e12d131a41fcab9
SHA512efac6de96a7189795cc95d34ae535196252b2860622e0235a40187f0f3d7e41d8230a3b2dc84b948d74ac9f92ec3c2e7405280702b1fa74d011cfbd1eef3e95a
-
Filesize
398B
MD53c1b4f524b5272f52afd11202d2c153e
SHA16c4746b8c5acd92a02a80eb8671f4d695afc8294
SHA25677cde8e774ddf8e6108acc57789b33597306610283acbc0eb017d4170c7f04d4
SHA5124ce83710ec5c4e6621f657f33a0c6c1a247534480a26f342efa8d4032ace18d8be661c648b4cbe73e658bcc1836599f502a58958aa4f2584db61242ad5f9658a
-
Filesize
139KB
MD527ee250ccb466c6fda4f5c7ceaa80d3a
SHA126c2b61e0b442e9ca9de0597c3a6f289fb34a8ac
SHA2561e54a55ec1dca45e482e08df908b69cd107d41476d8d9e6c9e12d131a41fcab9
SHA512efac6de96a7189795cc95d34ae535196252b2860622e0235a40187f0f3d7e41d8230a3b2dc84b948d74ac9f92ec3c2e7405280702b1fa74d011cfbd1eef3e95a
-
Filesize
139KB
MD527ee250ccb466c6fda4f5c7ceaa80d3a
SHA126c2b61e0b442e9ca9de0597c3a6f289fb34a8ac
SHA2561e54a55ec1dca45e482e08df908b69cd107d41476d8d9e6c9e12d131a41fcab9
SHA512efac6de96a7189795cc95d34ae535196252b2860622e0235a40187f0f3d7e41d8230a3b2dc84b948d74ac9f92ec3c2e7405280702b1fa74d011cfbd1eef3e95a