Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 22:58

General

  • Target

    809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe

  • Size

    269KB

  • MD5

    076a6e93f37e0fc136e282d46bbe2801

  • SHA1

    8bc5d88456293e305215afd6c36244a901293e50

  • SHA256

    809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3

  • SHA512

    dcea2bcc71be8c5e943003a14b9e259287695b656d04734a02bcbc2fdf7a499abba780e217c77f957cae3ad238097cc02d715d83e1efeec8bc0f4b88201507c5

  • SSDEEP

    6144:gLrA7C3WTj43klok5R6QxKP9UDCxe4ZtYE6dxIQoWV:gfKqWwklok58FegtV6Z7V

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2260
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:3432
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:4688
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
            PID:3720
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3520
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3364
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                1⤵
                  PID:3260
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:8
                  • C:\Windows\Explorer.EXE
                    C:\Windows\Explorer.EXE
                    1⤵
                      PID:3036
                      • C:\Users\Admin\AppData\Local\Temp\809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe
                        "C:\Users\Admin\AppData\Local\Temp\809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe"
                        2⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:516
                        • C:\Users\Admin\AppData\Local\Temp\Yxpys\tiyjn.exe
                          "C:\Users\Admin\AppData\Local\Temp\Yxpys\tiyjn.exe"
                          3⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2496
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JMQA25F.bat"
                          3⤵
                            PID:4392
                      • C:\Windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        1⤵
                          PID:2364
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                          1⤵
                            PID:2276

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\JMQA25F.bat

                            Filesize

                            274B

                            MD5

                            2f13710c719415dee897be182dcd36f2

                            SHA1

                            b94f4a03ed0bf4cb86cefacc289f95cb2b8db694

                            SHA256

                            c123812058051b5dbc9fd383d1045312cc0eb7a873a560e619a83c045ed7d516

                            SHA512

                            628d35be0deac65716cf48f57159ae7a09045fcda2f595c52eca110eeade9091a7584dfb95a3744ad6c82430cf79dbc820289abadb51b6ef5db53a30295a9478

                          • C:\Users\Admin\AppData\Local\Temp\Yxpys\tiyjn.exe

                            Filesize

                            269KB

                            MD5

                            dac110c756487311f4a27c6252cd8888

                            SHA1

                            5538f5693a25fa1a35be30edf7bf188f67dc2413

                            SHA256

                            9d59e7c07167acacbc158cecccbf01ed72c6aa5751e04793fa1120bd95fbad92

                            SHA512

                            4a488a177c6b548157b84ac344558616011dd2d1a97bda2c8a2f838664637baa53d80fbf2ed2724bd8df64170c6b6a05d588327ccdaefb8e9e063c405e247c61

                          • C:\Users\Admin\AppData\Local\Temp\Yxpys\tiyjn.exe

                            Filesize

                            269KB

                            MD5

                            dac110c756487311f4a27c6252cd8888

                            SHA1

                            5538f5693a25fa1a35be30edf7bf188f67dc2413

                            SHA256

                            9d59e7c07167acacbc158cecccbf01ed72c6aa5751e04793fa1120bd95fbad92

                            SHA512

                            4a488a177c6b548157b84ac344558616011dd2d1a97bda2c8a2f838664637baa53d80fbf2ed2724bd8df64170c6b6a05d588327ccdaefb8e9e063c405e247c61

                          • memory/516-145-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/516-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/516-135-0x0000000000400000-0x000000000056C000-memory.dmp

                            Filesize

                            1.4MB

                          • memory/516-134-0x00000000007D0000-0x00000000007E9000-memory.dmp

                            Filesize

                            100KB

                          • memory/516-141-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/516-142-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/516-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/516-133-0x000000000083F000-0x0000000000842000-memory.dmp

                            Filesize

                            12KB

                          • memory/516-146-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/516-150-0x0000000000640000-0x0000000000682000-memory.dmp

                            Filesize

                            264KB

                          • memory/516-149-0x000000000083F000-0x0000000000842000-memory.dmp

                            Filesize

                            12KB

                          • memory/516-132-0x0000000000400000-0x000000000056C000-memory.dmp

                            Filesize

                            1.4MB

                          • memory/2496-162-0x00000000005F0000-0x0000000000609000-memory.dmp

                            Filesize

                            100KB

                          • memory/2496-159-0x000000000075F000-0x0000000000762000-memory.dmp

                            Filesize

                            12KB

                          • memory/2496-160-0x00000000005F0000-0x0000000000609000-memory.dmp

                            Filesize

                            100KB

                          • memory/4392-148-0x0000000000D80000-0x0000000000DC2000-memory.dmp

                            Filesize

                            264KB

                          • memory/4392-155-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/4392-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/4392-156-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/4392-157-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/4392-158-0x0000000000D80000-0x0000000000DC2000-memory.dmp

                            Filesize

                            264KB

                          • memory/4392-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/4392-152-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB

                          • memory/4392-151-0x000000006FFF0000-0x0000000070000000-memory.dmp

                            Filesize

                            64KB