Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe
Resource
win10v2004-20221111-en
General
-
Target
ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe
-
Size
228KB
-
MD5
28a8fa3018628d6810fd4e4d4c8e9d8f
-
SHA1
24c77e5a09f8b70fb7bfa0b50a457b16bdd1dc71
-
SHA256
ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987
-
SHA512
e7572e68cc72b5e96bc9c12f9dc3db73178392a62623f9aafde5ac1e7df44549d4b0885b91821279fb5b3a3c71b28ea280dd242d4c8c62ae90cea54934f2346a
-
SSDEEP
6144:+kwgqvwrIP/G1p3lfGH7Uq7AGxdskm4fIYO:+AWwrcG39GH7ZjddFO
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 936 wylue.exe 1412 wylue.exe -
Deletes itself 1 IoCs
pid Process 1136 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\Currentversion\Run wylue.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\Currentversion\Run wylue.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ifhodua = "C:\\Users\\Admin\\AppData\\Roaming\\Ceraum\\wylue.exe" wylue.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1876 set thread context of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 936 set thread context of 1412 936 wylue.exe 30 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Privacy ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe 1412 wylue.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe Token: SeSecurityPrivilege 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1876 wrote to memory of 1480 1876 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 28 PID 1480 wrote to memory of 936 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 29 PID 1480 wrote to memory of 936 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 29 PID 1480 wrote to memory of 936 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 29 PID 1480 wrote to memory of 936 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 29 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 936 wrote to memory of 1412 936 wylue.exe 30 PID 1412 wrote to memory of 1124 1412 wylue.exe 14 PID 1412 wrote to memory of 1124 1412 wylue.exe 14 PID 1412 wrote to memory of 1124 1412 wylue.exe 14 PID 1412 wrote to memory of 1124 1412 wylue.exe 14 PID 1412 wrote to memory of 1124 1412 wylue.exe 14 PID 1412 wrote to memory of 1212 1412 wylue.exe 13 PID 1412 wrote to memory of 1212 1412 wylue.exe 13 PID 1412 wrote to memory of 1212 1412 wylue.exe 13 PID 1412 wrote to memory of 1212 1412 wylue.exe 13 PID 1412 wrote to memory of 1212 1412 wylue.exe 13 PID 1412 wrote to memory of 1248 1412 wylue.exe 6 PID 1412 wrote to memory of 1248 1412 wylue.exe 6 PID 1412 wrote to memory of 1248 1412 wylue.exe 6 PID 1412 wrote to memory of 1248 1412 wylue.exe 6 PID 1412 wrote to memory of 1248 1412 wylue.exe 6 PID 1412 wrote to memory of 1480 1412 wylue.exe 28 PID 1412 wrote to memory of 1480 1412 wylue.exe 28 PID 1412 wrote to memory of 1480 1412 wylue.exe 28 PID 1412 wrote to memory of 1480 1412 wylue.exe 28 PID 1412 wrote to memory of 1480 1412 wylue.exe 28 PID 1480 wrote to memory of 1136 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 31 PID 1480 wrote to memory of 1136 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 31 PID 1480 wrote to memory of 1136 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 31 PID 1480 wrote to memory of 1136 1480 ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe 31 PID 1412 wrote to memory of 1136 1412 wylue.exe 31 PID 1412 wrote to memory of 1136 1412 wylue.exe 31 PID 1412 wrote to memory of 1136 1412 wylue.exe 31 PID 1412 wrote to memory of 1136 1412 wylue.exe 31 PID 1412 wrote to memory of 1136 1412 wylue.exe 31 PID 1412 wrote to memory of 1336 1412 wylue.exe 33 PID 1412 wrote to memory of 1336 1412 wylue.exe 33 PID 1412 wrote to memory of 1336 1412 wylue.exe 33 PID 1412 wrote to memory of 1336 1412 wylue.exe 33 PID 1412 wrote to memory of 1336 1412 wylue.exe 33 PID 1412 wrote to memory of 1260 1412 wylue.exe 34 PID 1412 wrote to memory of 1260 1412 wylue.exe 34 PID 1412 wrote to memory of 1260 1412 wylue.exe 34 PID 1412 wrote to memory of 1260 1412 wylue.exe 34 PID 1412 wrote to memory of 1260 1412 wylue.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe"C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe"C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe"3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe"C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe"C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa2d1f6ed.bat"4⤵
- Deletes itself
PID:1136
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1212
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1336
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD587cd58fb4eb0b93f43bd8373138c0844
SHA1ca9c2a56908d38bad695263b7d3a21549aa0abdd
SHA256715408e202ef010846a6ba3f2cea3a887179073f5ddb9877a854c1587397a131
SHA512b2856732c938ef2cba891b028a5c79dfdd8b3c13413026b4dba24dad4381b40659c5a6590fac0cc67997435f65e022ecfcd45c1ada49d669bc788ce7d9aebf9e
-
Filesize
228KB
MD53776afcc8bcf783d162aa9c090a9f5f4
SHA1729574170612557234ccba0a83fa4a026a18954b
SHA256cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403
SHA51217dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c
-
Filesize
228KB
MD53776afcc8bcf783d162aa9c090a9f5f4
SHA1729574170612557234ccba0a83fa4a026a18954b
SHA256cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403
SHA51217dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c
-
Filesize
228KB
MD53776afcc8bcf783d162aa9c090a9f5f4
SHA1729574170612557234ccba0a83fa4a026a18954b
SHA256cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403
SHA51217dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c
-
Filesize
228KB
MD53776afcc8bcf783d162aa9c090a9f5f4
SHA1729574170612557234ccba0a83fa4a026a18954b
SHA256cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403
SHA51217dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c
-
Filesize
228KB
MD53776afcc8bcf783d162aa9c090a9f5f4
SHA1729574170612557234ccba0a83fa4a026a18954b
SHA256cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403
SHA51217dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c