Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    25s
  • max time network
    27s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18/02/2024, 13:19

General

  • Target

    Kiray.exe

  • Size

    13KB

  • MD5

    f22ae972aee081ec86faa30e73d9675f

  • SHA1

    a559057e10f7e524688043ca283e2380739d6744

  • SHA256

    166865fdb90e7964e7ea57a282343026d878230215e5694145f88a8afb56132f

  • SHA512

    80c000c1ee73a402d0960ee768272096541786eacda7b938f9791ca3da067f5838c6850c74dff466cccde11851989062328b4a3d87b2eb99a6cac0efcf45f4c1

  • SSDEEP

    384:XTm/Ye8zdTyBsyqAIZhgMFfpX5xqd1SJ5m:XHWsyqAggUnJI

Score
7/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kiray.exe
    "C:\Users\Admin\AppData\Local\Temp\Kiray.exe"
    1⤵
    • Modifies system executable filetype association
    • Suspicious use of SetWindowsHookEx
    PID:2512
  • C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    240KB

    MD5

    258c25dd98657134aa6f6e57dd62e54c

    SHA1

    c82a6eb23bcaffc4c0e626802fa6d496ded2d515

    SHA256

    a72320ec0ad857d2c9d5a930b0455eace5b9651487b9e8a69b0cad32f7980871

    SHA512

    10df949327fb6f25dbcdac510f129820a376ac4f2ef039d76f720fae8e3bd94fbba3c4b3c6192622749fb7b946be8737644795526af2a8f604f9fad94bf290d6

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    240KB

    MD5

    4fafcf66027cd31922f84d574144401b

    SHA1

    81d043eb176cdd5a1ec95c1fa959edaa74016515

    SHA256

    5e20c540b196f59c42afc50455fd6b54559833ed7e878afe6f82eb8ccae774f4

    SHA512

    67329a4a4379fa25aa79dc3b3132e119712e28d2a9d1c3f0c482ba4cecff83b834b12d3c4c73479d3198e8f8d6fce66216532f82fc9443ffb5739282c64ede1d

  • C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

    Filesize

    1KB

    MD5

    48dd6cae43ce26b992c35799fcd76898

    SHA1

    8e600544df0250da7d634599ce6ee50da11c0355

    SHA256

    7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

    SHA512

    c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

  • memory/860-3-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/860-4-0x0000000073DED000-0x0000000073DF8000-memory.dmp

    Filesize

    44KB

  • memory/860-104-0x000000006CDA1000-0x000000006CDA2000-memory.dmp

    Filesize

    4KB

  • memory/860-136-0x0000000073DED000-0x0000000073DF8000-memory.dmp

    Filesize

    44KB

  • memory/2512-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2512-130-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB