Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 21:35

General

  • Target

    satan.exe

  • Size

    184KB

  • MD5

    c9c341eaf04c89933ed28cbc2739d325

  • SHA1

    c5b7d47aef3bd33a24293138fcba3a5ff286c2a8

  • SHA256

    1a0a2fd546e3c05e15b2db3b531cb8e8755641f5f1c17910ce2fb7bbce2a05b7

  • SHA512

    7cfa6ec0be0f5ae80404c6c709a6fd00ca10a18b6def5ca746611d0d32a9552f7961ab0ebf8a336b27f7058d700205be7fcc859a30d7d185aa9457267090f99b

  • SSDEEP

    3072:H8SIBtQnE7OhssdWJ5jy392aCmCbBq0ryEbh/Wl7hqU6Q4NJ15xgDbvSY5thfRb3:c7qvhssdu5jyYaCmCQVE6hqUI5sb9Rb3

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1092 -s 236
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2744 -s 276
        3⤵
          PID:836
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1168 -s 312
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2456
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2456 -s 272
          3⤵
            PID:2732
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Users\Admin\AppData\Local\Temp\satan.exe
          "C:\Users\Admin\AppData\Local\Temp\satan.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Users\Admin\AppData\Local\Temp\satan.exe
            "C:\Users\Admin\AppData\Local\Temp\satan.exe"
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2940
            • C:\Users\Admin\AppData\Roaming\Puehiv\yqsi.exe
              "C:\Users\Admin\AppData\Roaming\Puehiv\yqsi.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1532
              • C:\Users\Admin\AppData\Roaming\Puehiv\yqsi.exe
                "C:\Users\Admin\AppData\Roaming\Puehiv\yqsi.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2676
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_d67b136a.bat"
              4⤵
              • Deletes itself
              PID:2924
        • C:\Windows\System32\vssadmin.exe
          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
          2⤵
          • Interacts with shadow copies
          PID:1444
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "1017219433-765444425-19326936881640228321186086032-11013411571848656564-1728274869"
        1⤵
          PID:3020
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "-2049922866-1365135549-583211254-2059388654-20404874201636625487-1614964472-1692432138"
          1⤵
            PID:1016
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:1468
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 1468 -s 232
                2⤵
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:1932
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1116
            • C:\Windows\system32\Dwm.exe
              "C:\Windows\system32\Dwm.exe"
              1⤵
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:2316
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              1⤵
                PID:2912
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 2912 -s 448
                  2⤵
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2764
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                1⤵
                  PID:2680
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 2680 -s 560
                    2⤵
                      PID:2284

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\tmp_d67b136a.bat

                    Filesize

                    190B

                    MD5

                    eba6b6f806b2aedca250e80154119abe

                    SHA1

                    7d7bb6e34780bd841e17124bdd6112176b68f2d0

                    SHA256

                    398e8d923c49164dff5579a23df54d376007259c994308b3151ce59da3060fc4

                    SHA512

                    fcb2ce9f5f1301c8a9643bc0c7ce0f4199e26b901849aaafdb6bac49dea91f06c9f56b9cf1a356a4d554fe9c14f53ea82e06993b5bea5b42f2366a5d84db9fd0

                  • \Users\Admin\AppData\Roaming\Puehiv\yqsi.exe

                    Filesize

                    67KB

                    MD5

                    3a748fbd3d0e3e3d0ae3d041da5348bd

                    SHA1

                    317801cb486061bc4c814721bea0843167f545dc

                    SHA256

                    a5fd364590db6c17859daa087b76bca191d55069bd998512ea5ea7c3e0f731c4

                    SHA512

                    806ff7bd932d53d50a58f94897201663d1bfa8c25f0d1d49f6d834acd0c46fe5922a4ca13bc845a5f1e03a6cecee4940807a8bd982d3f2e451fe2885ea14987d

                  • memory/1016-91-0x0000000000110000-0x0000000000127000-memory.dmp

                    Filesize

                    92KB

                  • memory/1016-106-0x0000000000110000-0x0000000000127000-memory.dmp

                    Filesize

                    92KB

                  • memory/1092-39-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1092-35-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1092-41-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1092-37-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1168-44-0x0000000001DB0000-0x0000000001DC7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1168-46-0x0000000001DB0000-0x0000000001DC7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1168-48-0x0000000001DB0000-0x0000000001DC7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-63-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-57-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-50-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-51-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-52-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-61-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-55-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1200-59-0x0000000002B00000-0x0000000002B17000-memory.dmp

                    Filesize

                    92KB

                  • memory/1444-105-0x0000000000060000-0x0000000000077000-memory.dmp

                    Filesize

                    92KB

                  • memory/1444-85-0x0000000000060000-0x0000000000077000-memory.dmp

                    Filesize

                    92KB

                  • memory/1532-20-0x00000000005C0000-0x00000000005D7000-memory.dmp

                    Filesize

                    92KB

                  • memory/1532-17-0x00000000006E0000-0x000000000080D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1532-18-0x0000000000B80000-0x0000000000C89000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/1532-16-0x0000000000380000-0x000000000039F000-memory.dmp

                    Filesize

                    124KB

                  • memory/1532-12-0x00000000002B0000-0x0000000000379000-memory.dmp

                    Filesize

                    804KB

                  • memory/1532-14-0x0000000000410000-0x00000000004AF000-memory.dmp

                    Filesize

                    636KB

                  • memory/1932-127-0x0000000002640000-0x0000000002657000-memory.dmp

                    Filesize

                    92KB

                  • memory/1932-146-0x0000000002640000-0x0000000002657000-memory.dmp

                    Filesize

                    92KB

                  • memory/2316-139-0x0000000001AC0000-0x0000000001AD7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2316-147-0x0000000001AC0000-0x0000000001AD7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2456-76-0x00000000001A0000-0x00000000001B7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2456-74-0x00000000001A0000-0x00000000001B7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2456-78-0x00000000001A0000-0x00000000001B7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-137-0x0000000000400000-0x0000000000417000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-32-0x0000000002150000-0x0000000002259000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/2676-145-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-31-0x0000000000400000-0x0000000000417000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-30-0x00000000007A0000-0x0000000000811000-memory.dmp

                    Filesize

                    452KB

                  • memory/2676-22-0x0000000000400000-0x0000000000417000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-115-0x0000000003EB0000-0x0000000003EC7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-27-0x00000000004F0000-0x000000000058F000-memory.dmp

                    Filesize

                    636KB

                  • memory/2676-34-0x0000000003BD0000-0x0000000003BE7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-28-0x00000000002B0000-0x00000000002CF000-memory.dmp

                    Filesize

                    124KB

                  • memory/2676-33-0x0000000000400000-0x0000000000417000-memory.dmp

                    Filesize

                    92KB

                  • memory/2676-26-0x0000000000420000-0x00000000004E9000-memory.dmp

                    Filesize

                    804KB

                  • memory/2676-29-0x0000000000670000-0x000000000079D000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/2744-67-0x0000000000530000-0x0000000000547000-memory.dmp

                    Filesize

                    92KB

                  • memory/2744-100-0x00000000022A0000-0x00000000022A1000-memory.dmp

                    Filesize

                    4KB

                  • memory/2744-71-0x0000000000530000-0x0000000000547000-memory.dmp

                    Filesize

                    92KB

                  • memory/2744-69-0x0000000000530000-0x0000000000547000-memory.dmp

                    Filesize

                    92KB

                  • memory/2764-187-0x00000000002A0000-0x00000000002B7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2764-184-0x00000000022C0000-0x00000000022C1000-memory.dmp

                    Filesize

                    4KB

                  • memory/2764-175-0x00000000002A0000-0x00000000002B7000-memory.dmp

                    Filesize

                    92KB

                  • memory/2940-3-0x0000000000400000-0x0000000000412000-memory.dmp

                    Filesize

                    72KB

                  • memory/2940-0-0x0000000000400000-0x0000000000412000-memory.dmp

                    Filesize

                    72KB

                  • memory/2940-13-0x0000000000400000-0x0000000000412000-memory.dmp

                    Filesize

                    72KB

                  • memory/2940-2-0x0000000000400000-0x0000000000412000-memory.dmp

                    Filesize

                    72KB

                  • memory/3020-56-0x0000000000110000-0x0000000000127000-memory.dmp

                    Filesize

                    92KB

                  • memory/3020-60-0x0000000000110000-0x0000000000127000-memory.dmp

                    Filesize

                    92KB

                  • memory/3020-66-0x0000000000110000-0x0000000000127000-memory.dmp

                    Filesize

                    92KB

                  • memory/3020-58-0x0000000000110000-0x0000000000127000-memory.dmp

                    Filesize

                    92KB

                  • memory/3020-64-0x0000000000110000-0x0000000000127000-memory.dmp

                    Filesize

                    92KB