Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 21:28
Static task
static1
Behavioral task
behavioral1
Sample
8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe
Resource
win10v2004-20220812-en
General
-
Target
8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe
-
Size
93KB
-
MD5
c6f5d6270d704db347dc7ced3dd11f50
-
SHA1
3754660ef16306ce4489e4940ab98e654468588a
-
SHA256
8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd
-
SHA512
eb329315b41f9a844cd86765244a369721ab7908320d5d90a4e76b00bfd8c310e566a9bb225cb69522f145861635a61cb23bbc263515137acc6db1b8363d2601
-
SSDEEP
1536:CXyvtA0MYL3OpBlHDxpmzVurN4vjWif+Q5ei6HNdsngRIhs2GDm:Cqt+XFpO0OvZfNTgGhhGa
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run SysAnti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SysAnti = "C:\\Program Files (x86)\\Common Files\\SysAnti.exe" SysAnti.exe -
Executes dropped EXE 1 IoCs
pid Process 4880 SysAnti.exe -
Loads dropped DLL 3 IoCs
pid Process 428 Rundll32.exe 428 Rundll32.exe 4924 Rundll32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4880 set thread context of 4824 4880 SysAnti.exe 84 -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\SysAnti.exe 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe File created C:\Program Files (x86)\Common Files\SysAnti.exe 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\Fonts\tbvws.fon 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe File created C:\Windows\Fonts\coeo.fon Rundll32.exe File opened for modification C:\Windows\Fonts\coeo.fon Rundll32.exe File created C:\Windows\Fonts\tdukl.fon SysAnti.exe File created C:\Windows\Fonts\chnb.fon Rundll32.exe File opened for modification C:\Windows\Fonts\chnb.fon Rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4768 4824 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 4880 SysAnti.exe 4880 SysAnti.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe Token: SeDebugPrivilege 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe Token: SeDebugPrivilege 428 Rundll32.exe Token: SeDebugPrivilege 4880 SysAnti.exe Token: SeDebugPrivilege 4880 SysAnti.exe Token: SeDebugPrivilege 4924 Rundll32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3892 wrote to memory of 428 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 81 PID 3892 wrote to memory of 428 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 81 PID 3892 wrote to memory of 428 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 81 PID 3892 wrote to memory of 4880 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 82 PID 3892 wrote to memory of 4880 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 82 PID 3892 wrote to memory of 4880 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 82 PID 4880 wrote to memory of 4924 4880 SysAnti.exe 83 PID 4880 wrote to memory of 4924 4880 SysAnti.exe 83 PID 4880 wrote to memory of 4924 4880 SysAnti.exe 83 PID 4880 wrote to memory of 4824 4880 SysAnti.exe 84 PID 4880 wrote to memory of 4824 4880 SysAnti.exe 84 PID 4880 wrote to memory of 4824 4880 SysAnti.exe 84 PID 4880 wrote to memory of 4824 4880 SysAnti.exe 84 PID 4880 wrote to memory of 4824 4880 SysAnti.exe 84 PID 3892 wrote to memory of 4748 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 86 PID 3892 wrote to memory of 4748 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 86 PID 3892 wrote to memory of 4748 3892 8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe"C:\Users\Admin\AppData\Local\Temp\8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\Rundll32.exeC:\Windows\System32\Rundll32.exe "C:\Windows\Fonts\tbvws.fon",MyKILLEntry2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
C:\Program Files (x86)\Common Files\SysAnti.exe"C:\Program Files (x86)\Common Files\SysAnti.exe" -One2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\Rundll32.exeC:\Windows\System32\Rundll32.exe "C:\Windows\Fonts\tdukl.fon",MyKILLEntry3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\System32\Svchost.exe3⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 124⤵
- Program crash
PID:4768
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\8ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd.exe" > nul2⤵PID:4748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4824 -ip 48241⤵PID:4692
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5c6f5d6270d704db347dc7ced3dd11f50
SHA13754660ef16306ce4489e4940ab98e654468588a
SHA2568ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd
SHA512eb329315b41f9a844cd86765244a369721ab7908320d5d90a4e76b00bfd8c310e566a9bb225cb69522f145861635a61cb23bbc263515137acc6db1b8363d2601
-
Filesize
93KB
MD5c6f5d6270d704db347dc7ced3dd11f50
SHA13754660ef16306ce4489e4940ab98e654468588a
SHA2568ba30df49f94005822b3d1264121c1ec3ae879fd27f798e58b3608b701d265dd
SHA512eb329315b41f9a844cd86765244a369721ab7908320d5d90a4e76b00bfd8c310e566a9bb225cb69522f145861635a61cb23bbc263515137acc6db1b8363d2601
-
Filesize
31KB
MD5e3b07bfb8f477249293bb7f74f81c62e
SHA1cba4bf1be14055ac14b5979e08206fdaaa395294
SHA256a52cce9148b56de137624466dad8067297e2aa995c9e2c272ff248682f6cfa33
SHA5126dd2e1f618729ddc7c65e25d367c43ac9350477c199b56fa68540063b6dad316e0eb9ce67cbd2ece83102d34444095e38280d908065148941e7a788a284876a6
-
Filesize
31KB
MD5e3b07bfb8f477249293bb7f74f81c62e
SHA1cba4bf1be14055ac14b5979e08206fdaaa395294
SHA256a52cce9148b56de137624466dad8067297e2aa995c9e2c272ff248682f6cfa33
SHA5126dd2e1f618729ddc7c65e25d367c43ac9350477c199b56fa68540063b6dad316e0eb9ce67cbd2ece83102d34444095e38280d908065148941e7a788a284876a6
-
Filesize
31KB
MD5e3b07bfb8f477249293bb7f74f81c62e
SHA1cba4bf1be14055ac14b5979e08206fdaaa395294
SHA256a52cce9148b56de137624466dad8067297e2aa995c9e2c272ff248682f6cfa33
SHA5126dd2e1f618729ddc7c65e25d367c43ac9350477c199b56fa68540063b6dad316e0eb9ce67cbd2ece83102d34444095e38280d908065148941e7a788a284876a6
-
Filesize
31KB
MD5e3b07bfb8f477249293bb7f74f81c62e
SHA1cba4bf1be14055ac14b5979e08206fdaaa395294
SHA256a52cce9148b56de137624466dad8067297e2aa995c9e2c272ff248682f6cfa33
SHA5126dd2e1f618729ddc7c65e25d367c43ac9350477c199b56fa68540063b6dad316e0eb9ce67cbd2ece83102d34444095e38280d908065148941e7a788a284876a6
-
Filesize
31KB
MD5e3b07bfb8f477249293bb7f74f81c62e
SHA1cba4bf1be14055ac14b5979e08206fdaaa395294
SHA256a52cce9148b56de137624466dad8067297e2aa995c9e2c272ff248682f6cfa33
SHA5126dd2e1f618729ddc7c65e25d367c43ac9350477c199b56fa68540063b6dad316e0eb9ce67cbd2ece83102d34444095e38280d908065148941e7a788a284876a6