Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
Resource
win10v2004-20220901-en
General
-
Target
20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe
-
Size
2.0MB
-
MD5
1047310d2de8ca872b60a26f25d93d3a
-
SHA1
f2a195007976f6dc9bb9d5d6fc1470269c5a7e47
-
SHA256
20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06
-
SHA512
43c8255b2305e54c6437f127ad869dc4d7eb5dfa5b92615919ac1156337ca5c1e2d97234af471527db7d3e7567b27d6051664d767b4965715f89e865ec06a8d1
-
SSDEEP
49152:Rc//////NIc0OFN8kH3i+Yo72DvJQ65MAGH3CU9WxtK9:Rc//////NI3OFnitLDRb5N4f
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2576 KAntiH.exe -
resource yara_rule behavioral2/memory/3476-381-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-383-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-384-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-389-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-392-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-396-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-399-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-402-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-406-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-410-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-413-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-417-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-421-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-426-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-430-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-433-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-438-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-442-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-446-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-450-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-454-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-458-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-463-0x0000000002430000-0x000000000246E000-memory.dmp upx behavioral2/memory/3476-1545-0x0000000002430000-0x000000000246E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4824 set thread context of 3476 4824 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 81 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\inf\KAntiH.exe 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS KAntiH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer KAntiH.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe 2576 KAntiH.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3476 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 3476 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 3476 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 2576 KAntiH.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4824 wrote to memory of 3476 4824 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 81 PID 4824 wrote to memory of 3476 4824 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 81 PID 4824 wrote to memory of 3476 4824 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 81 PID 4824 wrote to memory of 3476 4824 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 81 PID 4824 wrote to memory of 3476 4824 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 81 PID 3476 wrote to memory of 2576 3476 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 82 PID 3476 wrote to memory of 2576 3476 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 82 PID 3476 wrote to memory of 2576 3476 20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe"C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exeC:\Users\Admin\AppData\Local\Temp\20af96f3d406d67375c28b4150ed1804b6f04197d640ce2ab4b479090d638c06.exe2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\inf\KAntiH.exeC:\Windows\inf\KAntiH.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
988KB
MD568c95b5bf71f2b84a5a30458ee23b9cd
SHA1cc3233cc88f4f3a11a417861b142f77aa4f8ba54
SHA2564a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8
SHA51223809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd
-
Filesize
988KB
MD568c95b5bf71f2b84a5a30458ee23b9cd
SHA1cc3233cc88f4f3a11a417861b142f77aa4f8ba54
SHA2564a283cd171965220da4feea145662c68a4a66a536b6bb7670cf707441dff23a8
SHA51223809fb6367fab7339573b61b8f814eaaccdebf92e297817d81c076df2fe7aca2ff8fc7aed2097884c75c9e27a79bbcc9464e09946a06c189ff89b2303cc18dd