Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 08:33

General

  • Target

    58778d3ebe0ca1ce1ad46e92bddb7178.exe

  • Size

    252KB

  • MD5

    58778d3ebe0ca1ce1ad46e92bddb7178

  • SHA1

    9e48da115edf0a4a0c0fdf39c417f29d91d63f4c

  • SHA256

    0509a733af4977382669821b83eefa38c8d6558c0d370d233b506dda487a8de2

  • SHA512

    f802220e8d37e2da353543b491b5d0d35248748a5c8a534e062ef8069f82f10af53e97b8a3b32c508754f26244ffb67406db9cbb40e5dc86d4a5a1660bb924bf

  • SSDEEP

    6144:wTlFiVGBngFg4S628gA/igGuncMkcH/AeKnvmb7/D26ppSgCbvfXG:cHigBnga4S628dFncMkcHIeKnvmb7/Dp

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58778d3ebe0ca1ce1ad46e92bddb7178.exe
    "C:\Users\Admin\AppData\Local\Temp\58778d3ebe0ca1ce1ad46e92bddb7178.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5244
    • C:\Users\Admin\saiyiic.exe
      "C:\Users\Admin\saiyiic.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\saiyiic.exe

    Filesize

    252KB

    MD5

    b29ec064171da90ab0ddd9e05555b662

    SHA1

    b6784c9dc797b1891041a3f4f34785afb584471a

    SHA256

    549978dc8ca61656b2a2506d050bc0269bc901f05fab7b3355e51b03d6ec6432

    SHA512

    2001b7a764c530aabfa586997621376c8e4f921678002235e0ba88f7c7c667ba93774249f1fc5ca801f159c26d75631685a2abe690e0da5cd5ac240496915554