Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2024, 20:41

General

  • Target

    48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe

  • Size

    196KB

  • MD5

    5eb837b123ae38fb189414cf6f071ad4

  • SHA1

    d05e46ed48539cd97930417859346e2121283dcb

  • SHA256

    48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174

  • SHA512

    92d750b5b1923c7085dcc3d1674f804329313ec510c8c15319737878f0489abf959fdf91defe405f72f3d96ef09e2ce1d4010e05c3c561bc9ef5ed0c4214f3fe

  • SSDEEP

    6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOX:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe
    "C:\Users\Admin\AppData\Local\Temp\48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\48FE69~1.EXE > nul
      2⤵
      • Deletes itself
      PID:2832
  • C:\Windows\Debug\ayahost.exe
    C:\Windows\Debug\ayahost.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\debug\ayahost.exe

    Filesize

    196KB

    MD5

    9341844aaf260a445d5aa883976da2d2

    SHA1

    c9d12c95710dd7a9b696dcf0b456a2bfeec8581a

    SHA256

    0170cedd1a45f60263bf52ce676440bd2f1c198012ff437cc9d802efb410758c

    SHA512

    649eff867ab34c408d07a936f20abbceaa8fab563a5cbb438c7591c22ff8f88da217cc2a74b817616d1f855abc1e792576e50bebf610ca0d579618b03051fecf