Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
21/11/2023, 04:34
General
-
Target
youdupdata.exe
-
Size
5.4MB
-
MD5
4309bcede75c0d955de1c59ab634d7e7
-
SHA1
73bb7a51945c60c2ae64e33b9728f43f2f2c83c4
-
SHA256
4edb1135db0ef587a2fc2fe749b60566cb3aaaac6fb81d04c7401c14b60225a5
-
SHA512
9d6a9be7dc544e80fa7e6cbb722e01b8a7e4b6e4c85f5a8dc89f6589f9d6dce9035afedf804c4deee6105bd562de925125a7fc2887af53e26a1d0ead85617e2b
-
SSDEEP
98304:1QGp99ObznpmJy2Ahua4MnQ7PRPH2u7gaQoZrIr56sF:1N90bTQs2bl/xXQkrIr5fF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\youdupdata.exe"C:\Users\Admin\AppData\Local\Temp\youdupdata.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\Runn\Yloux.exe"C:\windows\Runn\Yloux.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5f830fffb7313638a2479b84d64bde970
SHA1b92867bdc8fd0fcc657eefa0529ba4d05409eee2
SHA25681f83d39a34e2b0a2f2aa30093e4913eeae5345c761f189a1fcb946420b2b5e9
SHA512c0fbdcf7d684039bc45037e2a9c178f4c662d7bffe01f0aaa7b743ebb9b2773547f5bf39b7358989646432bddc5029f36f0f3038a552bcf45dd92c969d1d593f
-
Filesize
176KB
MD57e9d02bca3ab745c84117057f48b1a97
SHA1b17986a21b44749f042f4bf779c9b75ab7bce5bf
SHA256a3cd7777c4344f0c80140d2cdfce1b993a8653707de8a68490bfcc6fbfc63c1f
SHA512edfb1cff6736f4ebf5675c9d54039e036201715b89fe2233e790a7cb1796b10fb7c1016f305f13742427baae627c1f7bd32b43c0c8d9d7d7fda4440a4b9fefae
-
Filesize
3.1MB
MD5f830fffb7313638a2479b84d64bde970
SHA1b92867bdc8fd0fcc657eefa0529ba4d05409eee2
SHA25681f83d39a34e2b0a2f2aa30093e4913eeae5345c761f189a1fcb946420b2b5e9
SHA512c0fbdcf7d684039bc45037e2a9c178f4c662d7bffe01f0aaa7b743ebb9b2773547f5bf39b7358989646432bddc5029f36f0f3038a552bcf45dd92c969d1d593f
-
Filesize
3.1MB
MD5f830fffb7313638a2479b84d64bde970
SHA1b92867bdc8fd0fcc657eefa0529ba4d05409eee2
SHA25681f83d39a34e2b0a2f2aa30093e4913eeae5345c761f189a1fcb946420b2b5e9
SHA512c0fbdcf7d684039bc45037e2a9c178f4c662d7bffe01f0aaa7b743ebb9b2773547f5bf39b7358989646432bddc5029f36f0f3038a552bcf45dd92c969d1d593f
-
Filesize
8.6MB
-
Filesize
8.6MB
-
Filesize
6.0MB
-
Filesize
6.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
4KB
-
Filesize
8.6MB
-
Filesize
204KB
-
Filesize
1.6MB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
180KB
-
Filesize
272KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
204KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB