Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe
Resource
win10v2004-20231215-en
General
-
Target
48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe
-
Size
196KB
-
MD5
5eb837b123ae38fb189414cf6f071ad4
-
SHA1
d05e46ed48539cd97930417859346e2121283dcb
-
SHA256
48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174
-
SHA512
92d750b5b1923c7085dcc3d1674f804329313ec510c8c15319737878f0489abf959fdf91defe405f72f3d96ef09e2ce1d4010e05c3c561bc9ef5ed0c4214f3fe
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOX:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2832 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 ayahost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\ayahost.exe 48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe File opened for modification C:\Windows\Debug\ayahost.exe 48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ayahost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ayahost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2328 48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2832 2328 48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe 29 PID 2328 wrote to memory of 2832 2328 48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe 29 PID 2328 wrote to memory of 2832 2328 48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe 29 PID 2328 wrote to memory of 2832 2328 48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe"C:\Users\Admin\AppData\Local\Temp\48fe699f325e6a37f7e9a01e2ff6f3b8e7f56a0d49a928c1befa37acc74a7174.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\48FE69~1.EXE > nul2⤵
- Deletes itself
PID:2832
-
-
C:\Windows\Debug\ayahost.exeC:\Windows\Debug\ayahost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD59341844aaf260a445d5aa883976da2d2
SHA1c9d12c95710dd7a9b696dcf0b456a2bfeec8581a
SHA2560170cedd1a45f60263bf52ce676440bd2f1c198012ff437cc9d802efb410758c
SHA512649eff867ab34c408d07a936f20abbceaa8fab563a5cbb438c7591c22ff8f88da217cc2a74b817616d1f855abc1e792576e50bebf610ca0d579618b03051fecf