Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
226s -
max time network
309s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
Resource
win10v2004-20220901-en
General
-
Target
ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
-
Size
416KB
-
MD5
c6396bde5cff6957fc4a92f93439a548
-
SHA1
c13dc8354751753e3747a3e00210da05a0bcddb2
-
SHA256
ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623
-
SHA512
b7171022003a4b26b104e32ab396fc163790df0888c51411cf9443cd4ce6c92c8dddd6725def5f27cf5afafc25237cfee0665543779326fd504829178355ca1e
-
SSDEEP
6144:L6MMXUsbMG0XKnmSwzOzxUiXXPU++6b26jFNuo2PeUTLwfYdRVlAtg+C82FR:i/MfKmNzYbXM++6b26R5o1dRVwY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 468 afaki.exe -
Deletes itself 1 IoCs
pid Process 1412 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\Currentversion\Run afaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E8A35E48-3774-AD4D-52EE-D422474DF73F} = "C:\\Users\\Admin\\AppData\\Roaming\\Uruq\\afaki.exe" afaki.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1260 set thread context of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe 468 afaki.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 468 afaki.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1260 wrote to memory of 468 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 28 PID 1260 wrote to memory of 468 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 28 PID 1260 wrote to memory of 468 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 28 PID 1260 wrote to memory of 468 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 28 PID 468 wrote to memory of 1124 468 afaki.exe 13 PID 468 wrote to memory of 1124 468 afaki.exe 13 PID 468 wrote to memory of 1124 468 afaki.exe 13 PID 468 wrote to memory of 1124 468 afaki.exe 13 PID 468 wrote to memory of 1124 468 afaki.exe 13 PID 468 wrote to memory of 1192 468 afaki.exe 12 PID 468 wrote to memory of 1192 468 afaki.exe 12 PID 468 wrote to memory of 1192 468 afaki.exe 12 PID 468 wrote to memory of 1192 468 afaki.exe 12 PID 468 wrote to memory of 1192 468 afaki.exe 12 PID 468 wrote to memory of 1228 468 afaki.exe 11 PID 468 wrote to memory of 1228 468 afaki.exe 11 PID 468 wrote to memory of 1228 468 afaki.exe 11 PID 468 wrote to memory of 1228 468 afaki.exe 11 PID 468 wrote to memory of 1228 468 afaki.exe 11 PID 468 wrote to memory of 1260 468 afaki.exe 10 PID 468 wrote to memory of 1260 468 afaki.exe 10 PID 468 wrote to memory of 1260 468 afaki.exe 10 PID 468 wrote to memory of 1260 468 afaki.exe 10 PID 468 wrote to memory of 1260 468 afaki.exe 10 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 1260 wrote to memory of 1412 1260 ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe 29 PID 468 wrote to memory of 1476 468 afaki.exe 30 PID 468 wrote to memory of 1476 468 afaki.exe 30 PID 468 wrote to memory of 1476 468 afaki.exe 30 PID 468 wrote to memory of 1476 468 afaki.exe 30 PID 468 wrote to memory of 1476 468 afaki.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe"C:\Users\Admin\AppData\Local\Temp\ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Roaming\Uruq\afaki.exe"C:\Users\Admin\AppData\Roaming\Uruq\afaki.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:468
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf769432b.bat"2⤵
- Deletes itself
PID:1412
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1228
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "708725119177871769-1147132788-17670117041827569752102856477-186287368861643224"1⤵PID:1476
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
466B
MD5e21f16740416382e0bfecea74513c6ec
SHA101fb6ff850f894c596387689ae42945a4a0eeea4
SHA2566421f2fde50149806fd88eefe2df0a29ba5d68ec74adc0b7684f33f1a6438e27
SHA512893bfce742c60c2349781bc4647db76f235ae2c83e90d96ae8197533569d198b422c225354d78b7a5e04096d052e67b794eaa06c1d53e215c63aea7456c600b4
-
Filesize
307B
MD5a2e17e6bb12b5115023adbcbaec4791f
SHA15d30b3bd15a9e9bd5600b7c399c0a7fe815054f3
SHA2560706ca273f4532b02cd51e39e567573bacca3d85b8e5880cefba02c880592376
SHA512efc1af3be586ea6d476f6dcec6f3f484fb3517da0c4383781f512755263eea1ecd748634fefbcbd30b5c4bd49c464bdad1f13a67c2116ab6eab3c9c3d0bdd168
-
Filesize
416KB
MD521ae6ef0b0de1e1969d07d52a98e11a0
SHA11f47e37e21b36c98e09d2935c3169e6930b723c9
SHA256b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86
SHA512a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7
-
Filesize
416KB
MD521ae6ef0b0de1e1969d07d52a98e11a0
SHA11f47e37e21b36c98e09d2935c3169e6930b723c9
SHA256b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86
SHA512a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7
-
Filesize
416KB
MD521ae6ef0b0de1e1969d07d52a98e11a0
SHA11f47e37e21b36c98e09d2935c3169e6930b723c9
SHA256b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86
SHA512a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7
-
Filesize
416KB
MD521ae6ef0b0de1e1969d07d52a98e11a0
SHA11f47e37e21b36c98e09d2935c3169e6930b723c9
SHA256b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86
SHA512a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7