Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 00:13

General

  • Target

    2140b3395f2483e1df158c19b252ad17.exe

  • Size

    252KB

  • MD5

    2140b3395f2483e1df158c19b252ad17

  • SHA1

    d12c788829e0b0c7d13e9eb87ee4866e24f697c7

  • SHA256

    2f7c92580277a9430d2633a8a95aa11382ea07500a356934e3b76d4f5f6581c0

  • SHA512

    6edd950cf6bd6cce037876da15012dc62a0f0158d431c767456a64a52a4ceabe4899d09b4e5a9152d5743a176a5733b83d61c7157d7c2b5057dcfd39f2ccdb88

  • SSDEEP

    6144:WUxi2d1wlx34Z4mwD5eQpYgYV29G6McRgcVXOa/0udzUZZQMQCQQyA8lohYewTEN:Nic4eQpYgWMGYlViQQyBlohHwTE+70/t

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2140b3395f2483e1df158c19b252ad17.exe
    "C:\Users\Admin\AppData\Local\Temp\2140b3395f2483e1df158c19b252ad17.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Users\Admin\yoahe.exe
      "C:\Users\Admin\yoahe.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\yoahe.exe

    Filesize

    252KB

    MD5

    767df58d3a93810fa27698d66efc11c8

    SHA1

    fcce52c77dafdb2e6870dc47dd669810c3cae7cc

    SHA256

    80d0949d50bad65d0db727e6efecc7bfd5dcf67c4d522e2a2e0c1c6e58c5b77e

    SHA512

    9318504b9d7630f15228c76a45268f30196969d73d18ac9d5834d11c61247721391306ac07c92b933592778039c6e44d73a284dd3c77ab10b00cac3a94bb1a8b