Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe
-
Size
276KB
-
MD5
043a588ea1fb3ef938126bd70c478990
-
SHA1
c4faaf47cbd068c67f329c3dd2421b13c16a046a
-
SHA256
174700d6a90fa666845907b3a56db781d58a79e62428a50b876a5a38930f69cd
-
SHA512
19e0573c5f55a8376af544e661bef95218bf8a74beb67efa3821327618a49b9b6d9ff1aca4393a37a438979572834dc87329fb460343e054a377f03a2d79b8f8
-
SSDEEP
6144:8hNnyaJ1GoQx90Bk6AFeSboIdb3FXNbJ+:8hlqoQ916keooOb3FXNo
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2660 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2604 kikay.exe 2896 kikay.exe -
Loads dropped DLL 3 IoCs
pid Process 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 2604 kikay.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\{07AC19C1-C824-6255-A7D0-26EDE0DDD31B} = "C:\\Users\\Admin\\AppData\\Roaming\\Yzded\\kikay.exe" kikay.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2996 set thread context of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2604 set thread context of 2896 2604 kikay.exe 30 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Privacy NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 2604 kikay.exe 2604 kikay.exe 2604 kikay.exe 2604 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe 2896 kikay.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 2604 kikay.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 2996 wrote to memory of 1308 2996 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 28 PID 1308 wrote to memory of 2604 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 29 PID 1308 wrote to memory of 2604 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 29 PID 1308 wrote to memory of 2604 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 29 PID 1308 wrote to memory of 2604 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 29 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2604 wrote to memory of 2896 2604 kikay.exe 30 PID 2896 wrote to memory of 1112 2896 kikay.exe 13 PID 2896 wrote to memory of 1112 2896 kikay.exe 13 PID 2896 wrote to memory of 1112 2896 kikay.exe 13 PID 2896 wrote to memory of 1112 2896 kikay.exe 13 PID 2896 wrote to memory of 1112 2896 kikay.exe 13 PID 2896 wrote to memory of 1172 2896 kikay.exe 15 PID 2896 wrote to memory of 1172 2896 kikay.exe 15 PID 2896 wrote to memory of 1172 2896 kikay.exe 15 PID 2896 wrote to memory of 1172 2896 kikay.exe 15 PID 2896 wrote to memory of 1172 2896 kikay.exe 15 PID 2896 wrote to memory of 1200 2896 kikay.exe 14 PID 2896 wrote to memory of 1200 2896 kikay.exe 14 PID 2896 wrote to memory of 1200 2896 kikay.exe 14 PID 2896 wrote to memory of 1200 2896 kikay.exe 14 PID 2896 wrote to memory of 1200 2896 kikay.exe 14 PID 2896 wrote to memory of 1868 2896 kikay.exe 22 PID 2896 wrote to memory of 1868 2896 kikay.exe 22 PID 2896 wrote to memory of 1868 2896 kikay.exe 22 PID 2896 wrote to memory of 1868 2896 kikay.exe 22 PID 2896 wrote to memory of 1868 2896 kikay.exe 22 PID 2896 wrote to memory of 1308 2896 kikay.exe 28 PID 2896 wrote to memory of 1308 2896 kikay.exe 28 PID 2896 wrote to memory of 1308 2896 kikay.exe 28 PID 2896 wrote to memory of 1308 2896 kikay.exe 28 PID 2896 wrote to memory of 1308 2896 kikay.exe 28 PID 1308 wrote to memory of 2660 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 31 PID 1308 wrote to memory of 2660 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 31 PID 1308 wrote to memory of 2660 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 31 PID 1308 wrote to memory of 2660 1308 NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe 31 PID 2896 wrote to memory of 2660 2896 kikay.exe 31 PID 2896 wrote to memory of 2660 2896 kikay.exe 31 PID 2896 wrote to memory of 2660 2896 kikay.exe 31 PID 2896 wrote to memory of 2660 2896 kikay.exe 31 PID 2896 wrote to memory of 2660 2896 kikay.exe 31
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exeC:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Roaming\Yzded\kikay.exe"C:\Users\Admin\AppData\Roaming\Yzded\kikay.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Roaming\Yzded\kikay.exeC:\Users\Admin\AppData\Roaming\Yzded\kikay.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd10ce2c2.bat"4⤵
- Deletes itself
PID:2660
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
259B
MD5fd56c17198e68bed0666e45a9dd60acc
SHA19122cb30501975809e8a8dff0a4e2906782558a1
SHA256cf3f72237250aac5ab5168f40ebf78ad40f535a67d6d15a3df337b82816edf36
SHA5121f7392a41baf42949afb2e1d783178b12db0312164c004294674f0e03ac6d7c90636b1976200e1bb3b7ab26a8847d4fbc371ffcfd157b4e35d01593ce99ce6cc
-
Filesize
276KB
MD5d3e076a85dcd563fe4c0134c54e83cfc
SHA149966f392f058e409ae95459cf6b1a9f0e872e98
SHA2563d873624d8df6b255e19aff2dddb2c9ad225378df8be3ed2f97d7cdc792cf5a5
SHA512ec306d56a9cacb38279ef02d69d2d262b0509c780303142d11cb63856ac629967b29a84e66ab0a84f47fa88e129338e3f91b91b3f4a273f9d08985dd3952fe2a
-
Filesize
276KB
MD5d3e076a85dcd563fe4c0134c54e83cfc
SHA149966f392f058e409ae95459cf6b1a9f0e872e98
SHA2563d873624d8df6b255e19aff2dddb2c9ad225378df8be3ed2f97d7cdc792cf5a5
SHA512ec306d56a9cacb38279ef02d69d2d262b0509c780303142d11cb63856ac629967b29a84e66ab0a84f47fa88e129338e3f91b91b3f4a273f9d08985dd3952fe2a
-
Filesize
276KB
MD5d3e076a85dcd563fe4c0134c54e83cfc
SHA149966f392f058e409ae95459cf6b1a9f0e872e98
SHA2563d873624d8df6b255e19aff2dddb2c9ad225378df8be3ed2f97d7cdc792cf5a5
SHA512ec306d56a9cacb38279ef02d69d2d262b0509c780303142d11cb63856ac629967b29a84e66ab0a84f47fa88e129338e3f91b91b3f4a273f9d08985dd3952fe2a
-
Filesize
276KB
MD5d3e076a85dcd563fe4c0134c54e83cfc
SHA149966f392f058e409ae95459cf6b1a9f0e872e98
SHA2563d873624d8df6b255e19aff2dddb2c9ad225378df8be3ed2f97d7cdc792cf5a5
SHA512ec306d56a9cacb38279ef02d69d2d262b0509c780303142d11cb63856ac629967b29a84e66ab0a84f47fa88e129338e3f91b91b3f4a273f9d08985dd3952fe2a
-
Filesize
276KB
MD5d3e076a85dcd563fe4c0134c54e83cfc
SHA149966f392f058e409ae95459cf6b1a9f0e872e98
SHA2563d873624d8df6b255e19aff2dddb2c9ad225378df8be3ed2f97d7cdc792cf5a5
SHA512ec306d56a9cacb38279ef02d69d2d262b0509c780303142d11cb63856ac629967b29a84e66ab0a84f47fa88e129338e3f91b91b3f4a273f9d08985dd3952fe2a
-
Filesize
276KB
MD5d3e076a85dcd563fe4c0134c54e83cfc
SHA149966f392f058e409ae95459cf6b1a9f0e872e98
SHA2563d873624d8df6b255e19aff2dddb2c9ad225378df8be3ed2f97d7cdc792cf5a5
SHA512ec306d56a9cacb38279ef02d69d2d262b0509c780303142d11cb63856ac629967b29a84e66ab0a84f47fa88e129338e3f91b91b3f4a273f9d08985dd3952fe2a
-
Filesize
276KB
MD5d3e076a85dcd563fe4c0134c54e83cfc
SHA149966f392f058e409ae95459cf6b1a9f0e872e98
SHA2563d873624d8df6b255e19aff2dddb2c9ad225378df8be3ed2f97d7cdc792cf5a5
SHA512ec306d56a9cacb38279ef02d69d2d262b0509c780303142d11cb63856ac629967b29a84e66ab0a84f47fa88e129338e3f91b91b3f4a273f9d08985dd3952fe2a