Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe
Resource
win10v2004-20220812-en
General
-
Target
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe
-
Size
200KB
-
MD5
1f2bccf67e9b1afc050da1ce36eb5930
-
SHA1
b65809055f908bed584c02997e31093ef940de91
-
SHA256
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
-
SHA512
b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
SSDEEP
6144:ceymVONYFdlD3iNYxVLdIz68TqLtU0D/szn:SmVONYFdlD3iNYxVLiButU0D/4
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1148 Sogou.exe 1692 Sougou.exe 556 Sogou.exe -
Loads dropped DLL 4 IoCs
pid Process 1308 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 1308 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 1692 Sougou.exe 1692 Sougou.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xiaoyu = "C:\\progra~1\\Common Files\\Sogou.exe" 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Sougou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xiaoyu = "C:\\progra~1\\Common Files\\Sogou.exe" Sougou.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Sougou.exe Sogou.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\progra~1\Common Files\Sogou.exe 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe File created C:\progra~1\Common Files\Sogou.exe Sougou.exe File created C:\progra~1\Common Files\Sogou.exe 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1308 wrote to memory of 1148 1308 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 27 PID 1308 wrote to memory of 1148 1308 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 27 PID 1308 wrote to memory of 1148 1308 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 27 PID 1308 wrote to memory of 1148 1308 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 27 PID 1692 wrote to memory of 556 1692 Sougou.exe 29 PID 1692 wrote to memory of 556 1692 Sougou.exe 29 PID 1692 wrote to memory of 556 1692 Sougou.exe 29 PID 1692 wrote to memory of 556 1692 Sougou.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe"C:\Users\Admin\AppData\Local\Temp\7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\progra~1\Common Files\Sogou.exe"C:\progra~1\Common Files\Sogou.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1148
-
-
C:\Windows\SysWOW64\Sougou.exeC:\Windows\SysWOW64\Sougou.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\progra~1\Common Files\Sogou.exe"C:\progra~1\Common Files\Sogou.exe"2⤵
- Executes dropped EXE
PID:556
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
27.2MB
MD5707d22474ca0ee493a34abad69e3a78d
SHA128cf8c705687c022b3dff350337ef0cdf89cc97c
SHA256db8027e6a768b9a38a9fb830317865ea17c7f5ab59a3cd3af8216e980a874fb7
SHA512ffe76abb4aab216a9a16295bf153437a811e6e5af93936a8a0b75ee026ba1a960da7099a2b5ae8b9735423b9cadef9b8de22c46af37a803a74091695b27bb4db
-
Filesize
27.2MB
MD5707d22474ca0ee493a34abad69e3a78d
SHA128cf8c705687c022b3dff350337ef0cdf89cc97c
SHA256db8027e6a768b9a38a9fb830317865ea17c7f5ab59a3cd3af8216e980a874fb7
SHA512ffe76abb4aab216a9a16295bf153437a811e6e5af93936a8a0b75ee026ba1a960da7099a2b5ae8b9735423b9cadef9b8de22c46af37a803a74091695b27bb4db
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055