Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe
Resource
win10v2004-20231020-en
General
-
Target
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe
-
Size
193KB
-
MD5
98a7a9bfa7080f96ddf437cc1e66d3d2
-
SHA1
91238833ab01f0e1ef78306ed441770789fac04e
-
SHA256
809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6
-
SHA512
1cf4f2c8bd44c90f750384831985c343ae1e0a53e25b0aed0045fcccac07337048b9c7d890d64f7500b4f46564af8a14ea3c9ab4f8e8a7a7181050b057c4c795
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOh:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXs
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2148 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2528 ayahost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\ayahost.exe 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe File opened for modification C:\Windows\Debug\ayahost.exe 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ayahost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ayahost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2552 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2148 2552 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe 29 PID 2552 wrote to memory of 2148 2552 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe 29 PID 2552 wrote to memory of 2148 2552 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe 29 PID 2552 wrote to memory of 2148 2552 809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe"C:\Users\Admin\AppData\Local\Temp\809852ffea8c153ff88ddcad0299224e9177535e293ec0d580c61747b9248bf6.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\809852~1.EXE > nul2⤵
- Deletes itself
PID:2148
-
-
C:\Windows\Debug\ayahost.exeC:\Windows\Debug\ayahost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD5dcaa696e8b9661d979bffaa9cb2399dc
SHA1412580813e802241624d9e56d150d315e66fc444
SHA256b620a84f84d4f1315537f0062df6edef2746a93b36e51cca4639d8fe0f63e30f
SHA512c8526e642aff18dbb8e5e02ca4ba89c426210a1ac918b7ddebb842fada229668477717ab3d361f1faf7d797862a3ef691e0f003d0f47a91446d73d16e6d329fa