Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
197s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 04:43
Static task
static1
Behavioral task
behavioral1
Sample
99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe
Resource
win10v2004-20220812-en
General
-
Target
99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe
-
Size
301KB
-
MD5
dd99a3e96b75e49c640b338c805c9417
-
SHA1
2b7ee0a5aad735f308d234c619c09482cc35d82a
-
SHA256
99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d
-
SHA512
22b37a88d7913aaeabf3c2a01d56b0c1d11ee13a08cb570559410f13c9e249f78647509e7b1cf1b1d95bbc49f508d1474f0fe05a6e5d8820b9d6acc30033caae
-
SSDEEP
6144:N1lyVPodSdVmOOOl+Gi6BH0PnGhNA/KudjJJi0AMDaPVT9dL1SrMQAnP:NyxgSdoOOOp6GfAjje0UpLaMd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1712 ibihit.exe -
Deletes itself 1 IoCs
pid Process 1704 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run ibihit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ibihit = "C:\\Users\\Admin\\AppData\\Roaming\\Toicx\\ibihit.exe" ibihit.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 952 set thread context of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe 1712 ibihit.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 952 wrote to memory of 1712 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 28 PID 952 wrote to memory of 1712 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 28 PID 952 wrote to memory of 1712 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 28 PID 952 wrote to memory of 1712 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 28 PID 1712 wrote to memory of 1120 1712 ibihit.exe 7 PID 1712 wrote to memory of 1120 1712 ibihit.exe 7 PID 1712 wrote to memory of 1120 1712 ibihit.exe 7 PID 1712 wrote to memory of 1120 1712 ibihit.exe 7 PID 1712 wrote to memory of 1120 1712 ibihit.exe 7 PID 1712 wrote to memory of 1176 1712 ibihit.exe 15 PID 1712 wrote to memory of 1176 1712 ibihit.exe 15 PID 1712 wrote to memory of 1176 1712 ibihit.exe 15 PID 1712 wrote to memory of 1176 1712 ibihit.exe 15 PID 1712 wrote to memory of 1176 1712 ibihit.exe 15 PID 1712 wrote to memory of 1204 1712 ibihit.exe 14 PID 1712 wrote to memory of 1204 1712 ibihit.exe 14 PID 1712 wrote to memory of 1204 1712 ibihit.exe 14 PID 1712 wrote to memory of 1204 1712 ibihit.exe 14 PID 1712 wrote to memory of 1204 1712 ibihit.exe 14 PID 1712 wrote to memory of 952 1712 ibihit.exe 21 PID 1712 wrote to memory of 952 1712 ibihit.exe 21 PID 1712 wrote to memory of 952 1712 ibihit.exe 21 PID 1712 wrote to memory of 952 1712 ibihit.exe 21 PID 1712 wrote to memory of 952 1712 ibihit.exe 21 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29 PID 952 wrote to memory of 1704 952 99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe 29
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe"C:\Users\Admin\AppData\Local\Temp\99aa3bd929c2871f7824e0fb5c96052f5255883c9b7ff7d6189dde42b0b2f19d.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Roaming\Toicx\ibihit.exe"C:\Users\Admin\AppData\Roaming\Toicx\ibihit.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EGPA33.bat"3⤵
- Deletes itself
PID:1704
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302B
MD5154d205526ab76a4f175ddc787aef880
SHA11360ef48b906f5cd78fc5472ebbc37c86f74566b
SHA256124be7e21e54ede068019a18c4616e1ba5ed951a2d9057b8517eb229b4a62ec8
SHA512a3852a05523ebb79ff3b1220e3c6e4945ef40abbcdac01bdddfb43d9437053f84629fcf0325dc8d303f566a639725bfeeb0ef5cbae93b592b67a028f3ee0588c
-
Filesize
301KB
MD5348ed1415f7fcd77f7f9ff6b91dda6bf
SHA18c032166bfc5ac4a6e7790ad163435dfa3f10d37
SHA2564b7738f8a29ab5dbdc02bf17d15ede2912eb62d3bfd7e03fac26239ed4a19d90
SHA512dfcb82747c827b0aeed5eab2607a65b49b07787b308ac15852a7a7173c65de4d196b3cf68bb77dea2fa7c6a266512285ef9840396947d2dae3831e056e3839f6
-
Filesize
301KB
MD5348ed1415f7fcd77f7f9ff6b91dda6bf
SHA18c032166bfc5ac4a6e7790ad163435dfa3f10d37
SHA2564b7738f8a29ab5dbdc02bf17d15ede2912eb62d3bfd7e03fac26239ed4a19d90
SHA512dfcb82747c827b0aeed5eab2607a65b49b07787b308ac15852a7a7173c65de4d196b3cf68bb77dea2fa7c6a266512285ef9840396947d2dae3831e056e3839f6
-
Filesize
301KB
MD5348ed1415f7fcd77f7f9ff6b91dda6bf
SHA18c032166bfc5ac4a6e7790ad163435dfa3f10d37
SHA2564b7738f8a29ab5dbdc02bf17d15ede2912eb62d3bfd7e03fac26239ed4a19d90
SHA512dfcb82747c827b0aeed5eab2607a65b49b07787b308ac15852a7a7173c65de4d196b3cf68bb77dea2fa7c6a266512285ef9840396947d2dae3831e056e3839f6
-
Filesize
301KB
MD5348ed1415f7fcd77f7f9ff6b91dda6bf
SHA18c032166bfc5ac4a6e7790ad163435dfa3f10d37
SHA2564b7738f8a29ab5dbdc02bf17d15ede2912eb62d3bfd7e03fac26239ed4a19d90
SHA512dfcb82747c827b0aeed5eab2607a65b49b07787b308ac15852a7a7173c65de4d196b3cf68bb77dea2fa7c6a266512285ef9840396947d2dae3831e056e3839f6