Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe
Resource
win10v2004-20220901-en
General
-
Target
89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe
-
Size
330KB
-
MD5
074b01e83285b20eafc271a3d1fed283
-
SHA1
b410b0733e6d9adcbf14bcb009235d05465f97ac
-
SHA256
89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9
-
SHA512
8cde8e4e7d87367e9df729f3dc662e947cd86b7dfd896d0c4bbccfe25b5bd07ddeee767966673274f43581127c32fa65c6ca07f8b2f17a78255a9fe9c04925a9
-
SSDEEP
6144:wU1tnxKApiXZcKgGEoi9P7DGXfszPxuRiIdn+:Xtn4A2+KjEL9z6cPxqiC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1392 tiofud.exe -
Deletes itself 1 IoCs
pid Process 364 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\Currentversion\Run tiofud.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\{91C05068-4FEF-AD4D-7F1F-8FEC7D0BACF1} = "C:\\Users\\Admin\\AppData\\Roaming\\Teep\\tiofud.exe" tiofud.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1148 set thread context of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe 1392 tiofud.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 1392 tiofud.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1148 wrote to memory of 1392 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 27 PID 1148 wrote to memory of 1392 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 27 PID 1148 wrote to memory of 1392 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 27 PID 1148 wrote to memory of 1392 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 27 PID 1148 wrote to memory of 1392 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 27 PID 1148 wrote to memory of 1392 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 27 PID 1148 wrote to memory of 1392 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 27 PID 1392 wrote to memory of 1228 1392 tiofud.exe 12 PID 1392 wrote to memory of 1228 1392 tiofud.exe 12 PID 1392 wrote to memory of 1228 1392 tiofud.exe 12 PID 1392 wrote to memory of 1228 1392 tiofud.exe 12 PID 1392 wrote to memory of 1228 1392 tiofud.exe 12 PID 1392 wrote to memory of 1320 1392 tiofud.exe 13 PID 1392 wrote to memory of 1320 1392 tiofud.exe 13 PID 1392 wrote to memory of 1320 1392 tiofud.exe 13 PID 1392 wrote to memory of 1320 1392 tiofud.exe 13 PID 1392 wrote to memory of 1320 1392 tiofud.exe 13 PID 1392 wrote to memory of 1380 1392 tiofud.exe 14 PID 1392 wrote to memory of 1380 1392 tiofud.exe 14 PID 1392 wrote to memory of 1380 1392 tiofud.exe 14 PID 1392 wrote to memory of 1380 1392 tiofud.exe 14 PID 1392 wrote to memory of 1380 1392 tiofud.exe 14 PID 1392 wrote to memory of 1148 1392 tiofud.exe 26 PID 1392 wrote to memory of 1148 1392 tiofud.exe 26 PID 1392 wrote to memory of 1148 1392 tiofud.exe 26 PID 1392 wrote to memory of 1148 1392 tiofud.exe 26 PID 1392 wrote to memory of 1148 1392 tiofud.exe 26 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28 PID 1148 wrote to memory of 364 1148 89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe 28
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1228
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1320
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe"C:\Users\Admin\AppData\Local\Temp\89db71a57803f508953c6b95fe74daf698bd9d63ab52c1de438db7252fd2a9d9.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Roaming\Teep\tiofud.exe"C:\Users\Admin\AppData\Roaming\Teep\tiofud.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1392
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp8f36cf4d.bat"3⤵
- Deletes itself
PID:364
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD509bf0bc71dc62ca6897c112d206ed033
SHA18626ee679818fa334506ab0e442eefcd216e5245
SHA256a5e95c583a3191192e07efe297ce1f8e4582b3fd2d3be608372b2ec764ecb1ca
SHA51299dab7260858f6cb139642655a131c3cf5b7e9ae2fafb20002de62058537f56ad384bbd2f0eb479f2ac6a182c0b10198b14d8250521349186a1d7b3b81431db8
-
Filesize
330KB
MD5d2a524303725344c6b5c4573877e23a8
SHA1ecb477beaacea9492e1baeaad5537ea1c26ed091
SHA2568cf6fa2463b62418615ead0ca9d9cea8d8753bb77961cd3beb23db8d34b201f1
SHA512ed40fe52ec5468f5e53f52cdbe77b155617dd0c6cbd243e7ef913b5e74ced962ebc7af9256ba9d51a19381645b5a0e343ed767c731a4da214633f1dbdda03787
-
Filesize
330KB
MD5d2a524303725344c6b5c4573877e23a8
SHA1ecb477beaacea9492e1baeaad5537ea1c26ed091
SHA2568cf6fa2463b62418615ead0ca9d9cea8d8753bb77961cd3beb23db8d34b201f1
SHA512ed40fe52ec5468f5e53f52cdbe77b155617dd0c6cbd243e7ef913b5e74ced962ebc7af9256ba9d51a19381645b5a0e343ed767c731a4da214633f1dbdda03787
-
Filesize
330KB
MD5d2a524303725344c6b5c4573877e23a8
SHA1ecb477beaacea9492e1baeaad5537ea1c26ed091
SHA2568cf6fa2463b62418615ead0ca9d9cea8d8753bb77961cd3beb23db8d34b201f1
SHA512ed40fe52ec5468f5e53f52cdbe77b155617dd0c6cbd243e7ef913b5e74ced962ebc7af9256ba9d51a19381645b5a0e343ed767c731a4da214633f1dbdda03787