Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
899a9b29918f65aa44a13b6781d154f9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
899a9b29918f65aa44a13b6781d154f9.exe
Resource
win10v2004-20231215-en
General
-
Target
899a9b29918f65aa44a13b6781d154f9.exe
-
Size
363KB
-
MD5
899a9b29918f65aa44a13b6781d154f9
-
SHA1
448a053765c225afcdcd8241e902cad555d149cc
-
SHA256
a1589ed6f5ee39d426e7769fc06f04dca3fff89e32fb9be1b6bfb03209a583f1
-
SHA512
a758207f0e2108bd397cb3a222513e073ee610423122c508cee725c1eb38049932af6e45686a7a6721a1af170bec8b9eea92bf193460bf8cfb3f22b830e1726c
-
SSDEEP
6144:0Qq03ilYKQWwsctuEDBHlC8w9WuKc9mfhTNSBLJeQAJrs+z:0/0SlFvwVdNdeuphkBNRwrs+z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2188 voubyt.exe -
Loads dropped DLL 1 IoCs
pid Process 2264 899a9b29918f65aa44a13b6781d154f9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\{8D03B3C8-CEC5-AD4E-9D6C-4FF59E096CE8} = "C:\\Users\\Admin\\AppData\\Roaming\\Seomk\\voubyt.exe" voubyt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2264 set thread context of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 -
Program crash 2 IoCs
pid pid_target Process procid_target 2908 756 WerFault.exe 29 1616 2908 WerFault.exe 31 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 899a9b29918f65aa44a13b6781d154f9.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Privacy 899a9b29918f65aa44a13b6781d154f9.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe 2188 voubyt.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2264 899a9b29918f65aa44a13b6781d154f9.exe 2188 voubyt.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2188 2264 899a9b29918f65aa44a13b6781d154f9.exe 28 PID 2264 wrote to memory of 2188 2264 899a9b29918f65aa44a13b6781d154f9.exe 28 PID 2264 wrote to memory of 2188 2264 899a9b29918f65aa44a13b6781d154f9.exe 28 PID 2264 wrote to memory of 2188 2264 899a9b29918f65aa44a13b6781d154f9.exe 28 PID 2188 wrote to memory of 1128 2188 voubyt.exe 8 PID 2188 wrote to memory of 1128 2188 voubyt.exe 8 PID 2188 wrote to memory of 1128 2188 voubyt.exe 8 PID 2188 wrote to memory of 1128 2188 voubyt.exe 8 PID 2188 wrote to memory of 1128 2188 voubyt.exe 8 PID 2188 wrote to memory of 1216 2188 voubyt.exe 7 PID 2188 wrote to memory of 1216 2188 voubyt.exe 7 PID 2188 wrote to memory of 1216 2188 voubyt.exe 7 PID 2188 wrote to memory of 1216 2188 voubyt.exe 7 PID 2188 wrote to memory of 1216 2188 voubyt.exe 7 PID 2188 wrote to memory of 1256 2188 voubyt.exe 6 PID 2188 wrote to memory of 1256 2188 voubyt.exe 6 PID 2188 wrote to memory of 1256 2188 voubyt.exe 6 PID 2188 wrote to memory of 1256 2188 voubyt.exe 6 PID 2188 wrote to memory of 1256 2188 voubyt.exe 6 PID 2188 wrote to memory of 1632 2188 voubyt.exe 4 PID 2188 wrote to memory of 1632 2188 voubyt.exe 4 PID 2188 wrote to memory of 1632 2188 voubyt.exe 4 PID 2188 wrote to memory of 1632 2188 voubyt.exe 4 PID 2188 wrote to memory of 1632 2188 voubyt.exe 4 PID 2188 wrote to memory of 2264 2188 voubyt.exe 16 PID 2188 wrote to memory of 2264 2188 voubyt.exe 16 PID 2188 wrote to memory of 2264 2188 voubyt.exe 16 PID 2188 wrote to memory of 2264 2188 voubyt.exe 16 PID 2188 wrote to memory of 2264 2188 voubyt.exe 16 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 2264 wrote to memory of 756 2264 899a9b29918f65aa44a13b6781d154f9.exe 29 PID 756 wrote to memory of 2908 756 cmd.exe 31 PID 756 wrote to memory of 2908 756 cmd.exe 31 PID 756 wrote to memory of 2908 756 cmd.exe 31 PID 756 wrote to memory of 2908 756 cmd.exe 31 PID 2188 wrote to memory of 2128 2188 voubyt.exe 30 PID 2188 wrote to memory of 2128 2188 voubyt.exe 30 PID 2188 wrote to memory of 2128 2188 voubyt.exe 30 PID 2188 wrote to memory of 2128 2188 voubyt.exe 30 PID 2188 wrote to memory of 2128 2188 voubyt.exe 30 PID 2188 wrote to memory of 2908 2188 voubyt.exe 31 PID 2188 wrote to memory of 2908 2188 voubyt.exe 31 PID 2188 wrote to memory of 2908 2188 voubyt.exe 31 PID 2188 wrote to memory of 2908 2188 voubyt.exe 31 PID 2188 wrote to memory of 2908 2188 voubyt.exe 31 PID 2908 wrote to memory of 1616 2908 WerFault.exe 32 PID 2908 wrote to memory of 1616 2908 WerFault.exe 32 PID 2908 wrote to memory of 1616 2908 WerFault.exe 32 PID 2908 wrote to memory of 1616 2908 WerFault.exe 32
Processes
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1632
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\899a9b29918f65aa44a13b6781d154f9.exe"C:\Users\Admin\AppData\Local\Temp\899a9b29918f65aa44a13b6781d154f9.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Roaming\Seomk\voubyt.exe"C:\Users\Admin\AppData\Roaming\Seomk\voubyt.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2188
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc5d8d510.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 1164⤵
- Program crash
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 5365⤵
- Program crash
PID:1616
-
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1216
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2734379519411917562137382872-19743674288006063001706700938-811254384-734949846"1⤵PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD52bdd4aa67fe665b549483f0f8c4eeb59
SHA1405e28651bda328b8a3e85a576608fddad0c77c4
SHA25673a4b1fe33e6e28bab56e8f88fb081280b967fb7650b16f4a70b5744f9ce23ee
SHA512a11c0ef54d2ea7f1ad38e228a8b97f27863fe05f3a6d0adefea089bafcc51fda8e47880acd5dd4eed67734182c050431fef07f2e5f4ae63b34ab1fa3d70f4897