Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 04:28

General

  • Target

    20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe

  • Size

    2.0MB

  • MD5

    1047310d2de8ca872b60a26f25d93d3a

  • SHA1

    f2a195007976f6dc9bb9d5d6fc1470269c5a7e47

  • SHA256

    20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06

  • SHA512

    43c8255b2305e54c6437f127ad869dc4d7eb5dfa5b92615919ac1156337ca5c1e2d97234af471527db7d3e7567b27d6051664d767b4965715f89e865ec06a8d1

  • SSDEEP

    49152:Rc//////NIc0OFN8kH3i+Yo72DvJQ65MAGH3CU9WxtK9:Rc//////NI3OFnitLDRb5N4f

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
    "C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
      C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
      2⤵
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Windows\inf\KAntiH.exe
        C:\Windows\inf\KAntiH.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\INF\KAntiH.exe

    Filesize

    988KB

    MD5

    68c95b5bf71f2b84a5a30458ee23b9cd

    SHA1

    cc3233cc88f4f3a11a417861b142f77aa4f8ba54

    SHA256

    4a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8

    SHA512

    23809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd

  • C:\Windows\inf\KAntiH.exe

    Filesize

    988KB

    MD5

    68c95b5bf71f2b84a5a30458ee23b9cd

    SHA1

    cc3233cc88f4f3a11a417861b142f77aa4f8ba54

    SHA256

    4a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8

    SHA512

    23809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd

  • memory/2576-145-0x0000000076A00000-0x0000000076A7A000-memory.dmp

    Filesize

    488KB

  • memory/2576-1547-0x0000000000400000-0x00000000004F7000-memory.dmp

    Filesize

    988KB

  • memory/2576-1546-0x0000000002A50000-0x0000000002B50000-memory.dmp

    Filesize

    1024KB

  • memory/2576-1544-0x0000000002A50000-0x0000000002B50000-memory.dmp

    Filesize

    1024KB

  • memory/2576-141-0x0000000000400000-0x00000000004F7000-memory.dmp

    Filesize

    988KB

  • memory/2576-140-0x0000000077C50000-0x0000000077DF3000-memory.dmp

    Filesize

    1.6MB

  • memory/2576-142-0x00000000765D0000-0x00000000767E5000-memory.dmp

    Filesize

    2.1MB

  • memory/2576-144-0x0000000075E90000-0x0000000076030000-memory.dmp

    Filesize

    1.6MB

  • memory/3476-421-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-446-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-383-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-384-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-389-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-392-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-396-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-399-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-402-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-406-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-410-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-413-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-417-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-426-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-430-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-433-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-438-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-442-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-381-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-450-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-454-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-458-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-463-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-465-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-467-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-470-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-472-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-474-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-479-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-477-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-481-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-483-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-1543-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-136-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-1545-0x0000000002430000-0x000000000246E000-memory.dmp

    Filesize

    248KB

  • memory/3476-135-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-133-0x0000000000400000-0x000000000074C000-memory.dmp

    Filesize

    3.3MB