Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 12:08
Static task
static1
Behavioral task
behavioral1
Sample
c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe
Resource
win10v2004-20220812-en
General
-
Target
c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe
-
Size
310KB
-
MD5
a30f2c81df70be83d0d55bc82112dc00
-
SHA1
e977a5eec190b67efae9a98d2f0a34affa2de1bd
-
SHA256
c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed
-
SHA512
3805ce02f9a574d902d1e400e27139b5842b35fafa17a9179b0c86ce5d5a8a63c6c14c43ae387ad37fa685ddba4c1eaebbab70134cb4ae3277d6ee6884d508ff
-
SSDEEP
6144:m4gmYsNiApqa2VEcb9a6dYTuFIpxVVv8ZsmHRzlN:m49FNtqaQV9GuFehGB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1836 faif.exe -
Deletes itself 1 IoCs
pid Process 1916 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run faif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7BD94DA8-4FEF-AD4D-5225-887A4931AB67} = "C:\\Users\\Admin\\AppData\\Roaming\\Ihqe\\faif.exe" faif.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1932 set thread context of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe 1836 faif.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1932 wrote to memory of 1836 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 28 PID 1932 wrote to memory of 1836 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 28 PID 1932 wrote to memory of 1836 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 28 PID 1932 wrote to memory of 1836 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 28 PID 1836 wrote to memory of 1192 1836 faif.exe 16 PID 1836 wrote to memory of 1192 1836 faif.exe 16 PID 1836 wrote to memory of 1192 1836 faif.exe 16 PID 1836 wrote to memory of 1192 1836 faif.exe 16 PID 1836 wrote to memory of 1192 1836 faif.exe 16 PID 1836 wrote to memory of 1272 1836 faif.exe 15 PID 1836 wrote to memory of 1272 1836 faif.exe 15 PID 1836 wrote to memory of 1272 1836 faif.exe 15 PID 1836 wrote to memory of 1272 1836 faif.exe 15 PID 1836 wrote to memory of 1272 1836 faif.exe 15 PID 1836 wrote to memory of 1324 1836 faif.exe 14 PID 1836 wrote to memory of 1324 1836 faif.exe 14 PID 1836 wrote to memory of 1324 1836 faif.exe 14 PID 1836 wrote to memory of 1324 1836 faif.exe 14 PID 1836 wrote to memory of 1324 1836 faif.exe 14 PID 1836 wrote to memory of 1932 1836 faif.exe 27 PID 1836 wrote to memory of 1932 1836 faif.exe 27 PID 1836 wrote to memory of 1932 1836 faif.exe 27 PID 1836 wrote to memory of 1932 1836 faif.exe 27 PID 1836 wrote to memory of 1932 1836 faif.exe 27 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29 PID 1932 wrote to memory of 1916 1932 c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe 29
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe"C:\Users\Admin\AppData\Local\Temp\c05786950e98389602621418e49718c76aacfd4e6dba0f313ba241cdaadf4fed.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Roaming\Ihqe\faif.exe"C:\Users\Admin\AppData\Roaming\Ihqe\faif.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp45577fdb.bat"3⤵
- Deletes itself
PID:1916
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1272
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1192
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD5a03f0aa0b2b6cd6f438b355a7456947b
SHA17d2c0e44479a8b55422253fec29d09e21c0336d1
SHA256004203d1e84e0d3b51346f424e83532bfb52e66bfd2ab8dde0269ba044b042bb
SHA512c8632faee136b28962ecefede6904765bf43586773579d090b29c4db3c902a0ef04d6036b5000ab0e7cfcdeaba6a85e18ccbd2e01683046ef1da75abab868e2f
-
Filesize
310KB
MD5f23f6ed1a110cc5e605a53891d190711
SHA19658ff54dab7d333c0d79ac4b6fa74cf2b0b44b0
SHA256751c4c786910ef36ff378ac672c623384912f87e5b595c7e1223db3a1e7f27e8
SHA512d609b67dce6edacee0c67d10b4e468496c1d74ed9c6d2d0fa1eff5584778e6ad8cfdff6d5fbc758bd75c80fc2da04f0dbcc9c9cccfda038ecda707ab244b9cdb
-
Filesize
310KB
MD5f23f6ed1a110cc5e605a53891d190711
SHA19658ff54dab7d333c0d79ac4b6fa74cf2b0b44b0
SHA256751c4c786910ef36ff378ac672c623384912f87e5b595c7e1223db3a1e7f27e8
SHA512d609b67dce6edacee0c67d10b4e468496c1d74ed9c6d2d0fa1eff5584778e6ad8cfdff6d5fbc758bd75c80fc2da04f0dbcc9c9cccfda038ecda707ab244b9cdb
-
Filesize
310KB
MD5f23f6ed1a110cc5e605a53891d190711
SHA19658ff54dab7d333c0d79ac4b6fa74cf2b0b44b0
SHA256751c4c786910ef36ff378ac672c623384912f87e5b595c7e1223db3a1e7f27e8
SHA512d609b67dce6edacee0c67d10b4e468496c1d74ed9c6d2d0fa1eff5584778e6ad8cfdff6d5fbc758bd75c80fc2da04f0dbcc9c9cccfda038ecda707ab244b9cdb
-
Filesize
310KB
MD5f23f6ed1a110cc5e605a53891d190711
SHA19658ff54dab7d333c0d79ac4b6fa74cf2b0b44b0
SHA256751c4c786910ef36ff378ac672c623384912f87e5b595c7e1223db3a1e7f27e8
SHA512d609b67dce6edacee0c67d10b4e468496c1d74ed9c6d2d0fa1eff5584778e6ad8cfdff6d5fbc758bd75c80fc2da04f0dbcc9c9cccfda038ecda707ab244b9cdb