Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe
Resource
win10v2004-20220812-en
General
-
Target
79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe
-
Size
303KB
-
MD5
0670f593b0bb7eede65397c7cf0562c6
-
SHA1
ad6a176cc9d3b860f9784f627c0a96f856b9b394
-
SHA256
79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b
-
SHA512
d15c86c6968f7f6d4c18cd840729c3642edf56df846cfaf1b2334e515a9191d732cf1cd5a062314cc6a8f98c44ebed9e8747dc051ffc717236c78e65fa070573
-
SSDEEP
6144:zxDPnPsHhCeTcT3qA3H1+L0UCxx5Mr38U6TgRoRw4MziGybX2czYcCW9U1:zJPnPiT83qeHsL+75Mb8UrdNzTylzYc2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1932 emtu.exe -
Deletes itself 1 IoCs
pid Process 1924 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run emtu.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Emtu = "C:\\Users\\Admin\\AppData\\Roaming\\Zuet\\emtu.exe" emtu.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1116 set thread context of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe 1932 emtu.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1932 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 27 PID 1116 wrote to memory of 1932 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 27 PID 1116 wrote to memory of 1932 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 27 PID 1116 wrote to memory of 1932 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 27 PID 1932 wrote to memory of 1248 1932 emtu.exe 17 PID 1932 wrote to memory of 1248 1932 emtu.exe 17 PID 1932 wrote to memory of 1248 1932 emtu.exe 17 PID 1932 wrote to memory of 1248 1932 emtu.exe 17 PID 1932 wrote to memory of 1248 1932 emtu.exe 17 PID 1932 wrote to memory of 1360 1932 emtu.exe 16 PID 1932 wrote to memory of 1360 1932 emtu.exe 16 PID 1932 wrote to memory of 1360 1932 emtu.exe 16 PID 1932 wrote to memory of 1360 1932 emtu.exe 16 PID 1932 wrote to memory of 1360 1932 emtu.exe 16 PID 1932 wrote to memory of 1392 1932 emtu.exe 9 PID 1932 wrote to memory of 1392 1932 emtu.exe 9 PID 1932 wrote to memory of 1392 1932 emtu.exe 9 PID 1932 wrote to memory of 1392 1932 emtu.exe 9 PID 1932 wrote to memory of 1392 1932 emtu.exe 9 PID 1932 wrote to memory of 1116 1932 emtu.exe 15 PID 1932 wrote to memory of 1116 1932 emtu.exe 15 PID 1932 wrote to memory of 1116 1932 emtu.exe 15 PID 1932 wrote to memory of 1116 1932 emtu.exe 15 PID 1932 wrote to memory of 1116 1932 emtu.exe 15 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29 PID 1116 wrote to memory of 1924 1116 79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe 29
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe"C:\Users\Admin\AppData\Local\Temp\79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Roaming\Zuet\emtu.exe"C:\Users\Admin\AppData\Roaming\Zuet\emtu.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\SLTDB93.bat"3⤵
- Deletes itself
PID:1924
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1360
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1248
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
303B
MD57e2bd815362fc6e5620259d48ad2349c
SHA10720b54fbe9aaf94265dc4f5a8fe9845c9ab6ac8
SHA256b10f7b741725cb63a3df22475b0fcb51c5fc120b01598682b10a809816f0d8ae
SHA512734a9cdd0fbca0f26540120a3460ca41c78b9ea3e20954440b4341a0bf1732083d6ebd9e59e577dc2d1a0040fbb4b8a94a0563236f48c9fce4931accf9b1d89f
-
Filesize
303KB
MD509d9a0e8d2cf838e7423d179b77e7714
SHA1e3860cda84dd61b5d86a14c58a141fbceba3b78d
SHA2560802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82
SHA51202526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76
-
Filesize
303KB
MD509d9a0e8d2cf838e7423d179b77e7714
SHA1e3860cda84dd61b5d86a14c58a141fbceba3b78d
SHA2560802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82
SHA51202526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76
-
Filesize
303KB
MD509d9a0e8d2cf838e7423d179b77e7714
SHA1e3860cda84dd61b5d86a14c58a141fbceba3b78d
SHA2560802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82
SHA51202526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76
-
Filesize
303KB
MD509d9a0e8d2cf838e7423d179b77e7714
SHA1e3860cda84dd61b5d86a14c58a141fbceba3b78d
SHA2560802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82
SHA51202526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76