Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 08:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58778d3ebe0ca1ce1ad46e92bddb7178.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
58778d3ebe0ca1ce1ad46e92bddb7178.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
58778d3ebe0ca1ce1ad46e92bddb7178.exe
-
Size
252KB
-
MD5
58778d3ebe0ca1ce1ad46e92bddb7178
-
SHA1
9e48da115edf0a4a0c0fdf39c417f29d91d63f4c
-
SHA256
0509a733af4977382669821b83eefa38c8d6558c0d370d233b506dda487a8de2
-
SHA512
f802220e8d37e2da353543b491b5d0d35248748a5c8a534e062ef8069f82f10af53e97b8a3b32c508754f26244ffb67406db9cbb40e5dc86d4a5a1660bb924bf
-
SSDEEP
6144:wTlFiVGBngFg4S628gA/igGuncMkcH/AeKnvmb7/D26ppSgCbvfXG:cHigBnga4S628dFncMkcHIeKnvmb7/Dp
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 58778d3ebe0ca1ce1ad46e92bddb7178.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" saiyiic.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 58778d3ebe0ca1ce1ad46e92bddb7178.exe -
Executes dropped EXE 1 IoCs
pid Process 4876 saiyiic.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /k" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /G" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /f" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /g" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /z" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /e" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /p" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /H" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /Z" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /A" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /x" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /X" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /J" 58778d3ebe0ca1ce1ad46e92bddb7178.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /B" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /Y" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /n" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /O" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /L" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /W" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /S" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /y" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /J" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /a" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /j" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /F" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /b" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /w" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /U" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /E" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /K" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /h" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /v" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /q" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /o" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /T" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /d" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /P" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /r" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /Q" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /t" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /m" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /V" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /M" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /C" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /u" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /I" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /i" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /D" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /R" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /N" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /l" saiyiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saiyiic = "C:\\Users\\Admin\\saiyiic.exe /s" saiyiic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5244 58778d3ebe0ca1ce1ad46e92bddb7178.exe 5244 58778d3ebe0ca1ce1ad46e92bddb7178.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe 4876 saiyiic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5244 58778d3ebe0ca1ce1ad46e92bddb7178.exe 4876 saiyiic.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5244 wrote to memory of 4876 5244 58778d3ebe0ca1ce1ad46e92bddb7178.exe 93 PID 5244 wrote to memory of 4876 5244 58778d3ebe0ca1ce1ad46e92bddb7178.exe 93 PID 5244 wrote to memory of 4876 5244 58778d3ebe0ca1ce1ad46e92bddb7178.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\58778d3ebe0ca1ce1ad46e92bddb7178.exe"C:\Users\Admin\AppData\Local\Temp\58778d3ebe0ca1ce1ad46e92bddb7178.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\saiyiic.exe"C:\Users\Admin\saiyiic.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4876
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5b29ec064171da90ab0ddd9e05555b662
SHA1b6784c9dc797b1891041a3f4f34785afb584471a
SHA256549978dc8ca61656b2a2506d050bc0269bc901f05fab7b3355e51b03d6ec6432
SHA5122001b7a764c530aabfa586997621376c8e4f921678002235e0ba88f7c7c667ba93774249f1fc5ca801f159c26d75631685a2abe690e0da5cd5ac240496915554