Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe
Resource
win10v2004-20220812-en
General
-
Target
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe
-
Size
200KB
-
MD5
1f2bccf67e9b1afc050da1ce36eb5930
-
SHA1
b65809055f908bed584c02997e31093ef940de91
-
SHA256
7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
-
SHA512
b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
SSDEEP
6144:ceymVONYFdlD3iNYxVLdIz68TqLtU0D/szn:SmVONYFdlD3iNYxVLiButU0D/4
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3236 Sogou.exe 3188 Sougou.exe 2548 Sogou.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xiaoyu = "C:\\progra~1\\Common Files\\Sogou.exe" 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Sougou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xiaoyu = "C:\\progra~1\\Common Files\\Sogou.exe" Sougou.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Sougou.exe Sogou.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\progra~1\Common Files\Sogou.exe Sougou.exe File created C:\progra~1\Common Files\Sogou.exe 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe File opened for modification C:\progra~1\Common Files\Sogou.exe 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3800 wrote to memory of 3236 3800 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 79 PID 3800 wrote to memory of 3236 3800 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 79 PID 3800 wrote to memory of 3236 3800 7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe 79 PID 3188 wrote to memory of 2548 3188 Sougou.exe 81 PID 3188 wrote to memory of 2548 3188 Sougou.exe 81 PID 3188 wrote to memory of 2548 3188 Sougou.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe"C:\Users\Admin\AppData\Local\Temp\7122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\progra~1\Common Files\Sogou.exe"C:\progra~1\Common Files\Sogou.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3236
-
-
C:\Windows\SysWOW64\Sougou.exeC:\Windows\SysWOW64\Sougou.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\progra~1\Common Files\Sogou.exe"C:\progra~1\Common Files\Sogou.exe"2⤵
- Executes dropped EXE
PID:2548
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055
-
Filesize
27.2MB
MD5707d22474ca0ee493a34abad69e3a78d
SHA128cf8c705687c022b3dff350337ef0cdf89cc97c
SHA256db8027e6a768b9a38a9fb830317865ea17c7f5ab59a3cd3af8216e980a874fb7
SHA512ffe76abb4aab216a9a16295bf153437a811e6e5af93936a8a0b75ee026ba1a960da7099a2b5ae8b9735423b9cadef9b8de22c46af37a803a74091695b27bb4db
-
Filesize
27.2MB
MD5707d22474ca0ee493a34abad69e3a78d
SHA128cf8c705687c022b3dff350337ef0cdf89cc97c
SHA256db8027e6a768b9a38a9fb830317865ea17c7f5ab59a3cd3af8216e980a874fb7
SHA512ffe76abb4aab216a9a16295bf153437a811e6e5af93936a8a0b75ee026ba1a960da7099a2b5ae8b9735423b9cadef9b8de22c46af37a803a74091695b27bb4db
-
Filesize
200KB
MD51f2bccf67e9b1afc050da1ce36eb5930
SHA1b65809055f908bed584c02997e31093ef940de91
SHA2567122c70082f94c3b567d94c7e9875cb23f6ff244d48884f2882b8c304fc3bbc9
SHA512b5606bca5961b6c97e5e794edfa1e2299259db2d0a53a14fd6c6fa4f109ec898330e0d2e7f1161ace01e85be8b9b658ab86929c722eb4a6f7728bf027bc4f055