Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
03700cbd2577f4ea42124ae956438f89.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
03700cbd2577f4ea42124ae956438f89.exe
Resource
win10v2004-20231215-en
General
-
Target
03700cbd2577f4ea42124ae956438f89.exe
-
Size
26KB
-
MD5
03700cbd2577f4ea42124ae956438f89
-
SHA1
6d860e28d28d37897bb8add4e762fc21db149d9e
-
SHA256
addfa311eabf3be46876bd0eff80ddd4dd0b6afc505b23f08d40798080f5c537
-
SHA512
9f6d4ed72194b43ebf6c11c0bb390dd66939e0d151f15c375308e674db68942ce2a8277845bf69c07f5e53bb6b4328a191a7f83bbe5b423b210e454b35c686bf
-
SSDEEP
768:vbwBerYmMSgB/lQZs6gr4R6zKToeGyEY02UmPI5UUPeukukuI:zwBeMlJdoIr4bGyi+rP
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Drivers\beep.sys 03700cbd2577f4ea42124ae956438f89.exe File opened for modification C:\Windows\SysWOW64\Drivers\beep.sys 03700cbd2577f4ea42124ae956438f89.exe -
Executes dropped EXE 1 IoCs
pid Process 3636 MayaBabyMain.exe -
Loads dropped DLL 2 IoCs
pid Process 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\me.bat 03700cbd2577f4ea42124ae956438f89.exe File opened for modification C:\Windows\SysWOW64\me.bat attrib.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\MayaBaby\MayaBabySYS.dat 03700cbd2577f4ea42124ae956438f89.exe File created C:\Windows\MayaBaby\gaga.bat 03700cbd2577f4ea42124ae956438f89.exe File created C:\Windows\MayaBaby\MayaBabyDll.dat MayaBabyMain.exe File opened for modification C:\Windows\MayaBaby\MayaBabySYS.dat MayaBabyMain.exe File opened for modification C:\Windows\MayaBaby\MayaBabyDll.dat MayaBabyMain.exe File created C:\Windows\MayaBaby\MayaBabyDll.dat 03700cbd2577f4ea42124ae956438f89.exe File created C:\Windows\MayaBaby\MayaBabySYS.dat 03700cbd2577f4ea42124ae956438f89.exe File opened for modification C:\Windows\MayaBaby\MayaBabyDll.dat 03700cbd2577f4ea42124ae956438f89.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 3636 MayaBabyMain.exe 3636 MayaBabyMain.exe 2408 03700cbd2577f4ea42124ae956438f89.exe 2408 03700cbd2577f4ea42124ae956438f89.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 680 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2408 03700cbd2577f4ea42124ae956438f89.exe Token: SeDebugPrivilege 3636 MayaBabyMain.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2408 wrote to memory of 564 2408 03700cbd2577f4ea42124ae956438f89.exe 88 PID 2408 wrote to memory of 564 2408 03700cbd2577f4ea42124ae956438f89.exe 88 PID 2408 wrote to memory of 564 2408 03700cbd2577f4ea42124ae956438f89.exe 88 PID 564 wrote to memory of 3412 564 NET.exe 90 PID 564 wrote to memory of 3412 564 NET.exe 90 PID 564 wrote to memory of 3412 564 NET.exe 90 PID 2408 wrote to memory of 3264 2408 03700cbd2577f4ea42124ae956438f89.exe 95 PID 2408 wrote to memory of 3264 2408 03700cbd2577f4ea42124ae956438f89.exe 95 PID 2408 wrote to memory of 3264 2408 03700cbd2577f4ea42124ae956438f89.exe 95 PID 3264 wrote to memory of 1280 3264 NET.exe 96 PID 3264 wrote to memory of 1280 3264 NET.exe 96 PID 3264 wrote to memory of 1280 3264 NET.exe 96 PID 2408 wrote to memory of 4720 2408 03700cbd2577f4ea42124ae956438f89.exe 102 PID 2408 wrote to memory of 4720 2408 03700cbd2577f4ea42124ae956438f89.exe 102 PID 2408 wrote to memory of 4720 2408 03700cbd2577f4ea42124ae956438f89.exe 102 PID 3636 wrote to memory of 816 3636 MayaBabyMain.exe 11 PID 4720 wrote to memory of 3232 4720 cmd.exe 104 PID 4720 wrote to memory of 3232 4720 cmd.exe 104 PID 4720 wrote to memory of 3232 4720 cmd.exe 104 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3232 attrib.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\03700cbd2577f4ea42124ae956438f89.exe"C:\Users\Admin\AppData\Local\Temp\03700cbd2577f4ea42124ae956438f89.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\NET.exeNET STOP Beep2⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP Beep3⤵PID:3412
-
-
-
C:\Windows\SysWOW64\NET.exeNET START Beep2⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 START Beep3⤵PID:1280
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\me.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\attrib.exeattrib -h -s -r -a C:\Windows\system32\me.bat3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:3232
-
-
-
C:\Windows\MayaBaby\MayaBabyMain.exeC:\Windows\MayaBaby\MayaBabyMain.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD58908f4012fbb197175e1f59f20385a33
SHA1bdb5b3226d5edfa9de5f22fbd457e5ab6d62d10b
SHA2562389c45e0c6c0784a131ab2f4c5c794a06d8630f48ff14ed223b06a6d3f99034
SHA512a73894a22bd6489dc455bc45c5bf8e094ed7fb2cd477b26810d0ede4af8862be1946a27195e74f50571f41c2b6e9d36b8c5a178b6b01a9e0f66f32b66064c931
-
Filesize
26KB
MD503700cbd2577f4ea42124ae956438f89
SHA16d860e28d28d37897bb8add4e762fc21db149d9e
SHA256addfa311eabf3be46876bd0eff80ddd4dd0b6afc505b23f08d40798080f5c537
SHA5129f6d4ed72194b43ebf6c11c0bb390dd66939e0d151f15c375308e674db68942ce2a8277845bf69c07f5e53bb6b4328a191a7f83bbe5b423b210e454b35c686bf
-
Filesize
4KB
MD534b58d3df160986141117799dd8920c9
SHA167c3725081faa5d20d7217ee79151867f3703f81
SHA256b1c73ae97c1bac2d822c8e4bfcc37b15644a780ec8904974a8239f312a1049d8
SHA5121289e14c83ff8da9680d955101fbca7301666a10714c22bad0b146d15ce09aa53e04611d5380548c426ee8162482f31e38e0e55c115fa9aac822c32cce1678f0
-
Filesize
130B
MD5bb7c20ec76af354aede4ff2144151631
SHA1aac9ac901b7739b44a974384b0dcf57e227154c1
SHA256cfe9177f7001f8027de60bb3e87b64ead92fe0ae0d6ccb00f9e96bf10cbd4b30
SHA512605dc2620eb4ee691f6c8d0d947a82525ced4d32b13a2c121f22177910bf33905ed4ba96a27fafd74cb455092537c361290b3639ec49678a43f35573869fe609