Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe
Resource
win10v2004-20220901-en
General
-
Target
809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe
-
Size
269KB
-
MD5
076a6e93f37e0fc136e282d46bbe2801
-
SHA1
8bc5d88456293e305215afd6c36244a901293e50
-
SHA256
809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3
-
SHA512
dcea2bcc71be8c5e943003a14b9e259287695b656d04734a02bcbc2fdf7a499abba780e217c77f957cae3ad238097cc02d715d83e1efeec8bc0f4b88201507c5
-
SSDEEP
6144:gLrA7C3WTj43klok5R6QxKP9UDCxe4ZtYE6dxIQoWV:gfKqWwklok58FegtV6Z7V
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2496 tiyjn.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run tiyjn.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tiyjn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Yxpys\\tiyjn.exe" tiyjn.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 516 set thread context of 4392 516 809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe 83 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 516 809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe 516 809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe 2496 tiyjn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 2496 516 809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe 82 PID 516 wrote to memory of 2496 516 809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe 82 PID 516 wrote to memory of 2496 516 809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe 82 PID 2496 wrote to memory of 2260 2496 tiyjn.exe 13 PID 2496 wrote to memory of 2260 2496 tiyjn.exe 13 PID 2496 wrote to memory of 2260 2496 tiyjn.exe 13 PID 2496 wrote to memory of 2260 2496 tiyjn.exe 13 PID 2496 wrote to memory of 2260 2496 tiyjn.exe 13 PID 2496 wrote to memory of 2276 2496 tiyjn.exe 51 PID 2496 wrote to memory of 2276 2496 tiyjn.exe 51 PID 2496 wrote to memory of 2276 2496 tiyjn.exe 51 PID 2496 wrote to memory of 2276 2496 tiyjn.exe 51 PID 2496 wrote to memory of 2276 2496 tiyjn.exe 51 PID 2496 wrote to memory of 2364 2496 tiyjn.exe 50 PID 2496 wrote to memory of 2364 2496 tiyjn.exe 50 PID 2496 wrote to memory of 2364 2496 tiyjn.exe 50 PID 2496 wrote to memory of 2364 2496 tiyjn.exe 50 PID 2496 wrote to memory of 2364 2496 tiyjn.exe 50 PID 2496 wrote to memory of 3036 2496 tiyjn.exe 41 PID 2496 wrote to memory of 3036 2496 tiyjn.exe 41 PID 2496 wrote to memory of 3036 2496 tiyjn.exe 41 PID 2496 wrote to memory of 3036 2496 tiyjn.exe 41 PID 2496 wrote to memory of 3036 2496 tiyjn.exe 41 PID 2496 wrote to memory of 8 2496 tiyjn.exe 40 PID 2496 wrote to memory of 8 2496 tiyjn.exe 40 PID 2496 wrote to memory of 8 2496 tiyjn.exe 40 PID 2496 wrote to memory of 8 2496 tiyjn.exe 40 PID 2496 wrote to memory of 8 2496 tiyjn.exe 40 PID 2496 wrote to memory of 3260 2496 tiyjn.exe 39 PID 2496 wrote to memory of 3260 2496 tiyjn.exe 39 PID 2496 wrote to memory of 3260 2496 tiyjn.exe 39 PID 2496 wrote to memory of 3260 2496 tiyjn.exe 39 PID 2496 wrote to memory of 3260 2496 tiyjn.exe 39 PID 2496 wrote to memory of 3364 2496 tiyjn.exe 38 PID 2496 wrote to memory of 3364 2496 tiyjn.exe 38 PID 2496 wrote to memory of 3364 2496 tiyjn.exe 38 PID 2496 wrote to memory of 3364 2496 tiyjn.exe 38 PID 2496 wrote to memory of 3364 2496 tiyjn.exe 38 PID 2496 wrote to memory of 3432 2496 tiyjn.exe 15 PID 2496 wrote to memory of 3432 2496 tiyjn.exe 15 PID 2496 wrote to memory of 3432 2496 tiyjn.exe 15 PID 2496 wrote to memory of 3432 2496 tiyjn.exe 15 PID 2496 wrote to memory of 3432 2496 tiyjn.exe 15 PID 2496 wrote to memory of 3520 2496 tiyjn.exe 37 PID 2496 wrote to memory of 3520 2496 tiyjn.exe 37 PID 2496 wrote to memory of 3520 2496 tiyjn.exe 37 PID 2496 wrote to memory of 3520 2496 tiyjn.exe 37 PID 2496 wrote to memory of 3520 2496 tiyjn.exe 37 PID 2496 wrote to memory of 3720 2496 tiyjn.exe 36 PID 2496 wrote to memory of 3720 2496 tiyjn.exe 36 PID 2496 wrote to memory of 3720 2496 tiyjn.exe 36 PID 2496 wrote to memory of 3720 2496 tiyjn.exe 36 PID 2496 wrote to memory of 3720 2496 tiyjn.exe 36 PID 2496 wrote to memory of 4688 2496 tiyjn.exe 33 PID 2496 wrote to memory of 4688 2496 tiyjn.exe 33 PID 2496 wrote to memory of 4688 2496 tiyjn.exe 33 PID 2496 wrote to memory of 4688 2496 tiyjn.exe 33 PID 2496 wrote to memory of 4688 2496 tiyjn.exe 33 PID 2496 wrote to memory of 516 2496 tiyjn.exe 81 PID 2496 wrote to memory of 516 2496 tiyjn.exe 81 PID 2496 wrote to memory of 516 2496 tiyjn.exe 81 PID 2496 wrote to memory of 516 2496 tiyjn.exe 81 PID 2496 wrote to memory of 516 2496 tiyjn.exe 81 PID 516 wrote to memory of 4392 516 809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe 83
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2260
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3432
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4688
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3720
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3520
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3364
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:8
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe"C:\Users\Admin\AppData\Local\Temp\809f5007e7e771dbb791d08e166770b17c2de15908b300ef1a241ac9f23215d3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\Yxpys\tiyjn.exe"C:\Users\Admin\AppData\Local\Temp\Yxpys\tiyjn.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JMQA25F.bat"3⤵PID:4392
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2276
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
274B
MD52f13710c719415dee897be182dcd36f2
SHA1b94f4a03ed0bf4cb86cefacc289f95cb2b8db694
SHA256c123812058051b5dbc9fd383d1045312cc0eb7a873a560e619a83c045ed7d516
SHA512628d35be0deac65716cf48f57159ae7a09045fcda2f595c52eca110eeade9091a7584dfb95a3744ad6c82430cf79dbc820289abadb51b6ef5db53a30295a9478
-
Filesize
269KB
MD5dac110c756487311f4a27c6252cd8888
SHA15538f5693a25fa1a35be30edf7bf188f67dc2413
SHA2569d59e7c07167acacbc158cecccbf01ed72c6aa5751e04793fa1120bd95fbad92
SHA5124a488a177c6b548157b84ac344558616011dd2d1a97bda2c8a2f838664637baa53d80fbf2ed2724bd8df64170c6b6a05d588327ccdaefb8e9e063c405e247c61
-
Filesize
269KB
MD5dac110c756487311f4a27c6252cd8888
SHA15538f5693a25fa1a35be30edf7bf188f67dc2413
SHA2569d59e7c07167acacbc158cecccbf01ed72c6aa5751e04793fa1120bd95fbad92
SHA5124a488a177c6b548157b84ac344558616011dd2d1a97bda2c8a2f838664637baa53d80fbf2ed2724bd8df64170c6b6a05d588327ccdaefb8e9e063c405e247c61