Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe
Resource
win10v2004-20240226-en
General
-
Target
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe
-
Size
400KB
-
MD5
825f6c628b0732455c04d467d9298e26
-
SHA1
822d1fa15d0efeb463a420bd2228f86f9adc861b
-
SHA256
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5
-
SHA512
c9ea976224ed36eb9cdb80544fe2efdd0451477e9ca008fed9c8d7dea2e63d5356209d7ced7855194e0703a283c3f4dd1a23dd9c12cc4511b0b8fbe1b27d3c83
-
SSDEEP
6144:ZsYftV4tAyXuS/WiBWuVklOPce2imvDAPbBW6EWfQkmJyOj4ykpZq:fAdBFVkl6ItD4W6EWfQByOj4ykpZ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yaukin.exe -
Executes dropped EXE 1 IoCs
pid Process 2716 yaukin.exe -
Loads dropped DLL 2 IoCs
pid Process 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /e" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /w" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /i" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /o" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /v" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /p" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /z" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /r" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /f" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /v" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /b" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /m" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /h" 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /d" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /o" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /r" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /x" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /b" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /g" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /f" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /l" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /j" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /i" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /j" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /d" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /x" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /t" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /g" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /h" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /n" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /m" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /y" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /e" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /q" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /y" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /t" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /n" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /a" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /l" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /u" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /k" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /z" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /c" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /s" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /a" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /h" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /s" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /u" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /c" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /q" yaukin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /k" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /w" yaukin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /p" 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yaukin = "C:\\Users\\Admin\\yaukin.exe /p" yaukin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe 2716 yaukin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 2716 yaukin.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2716 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 28 PID 1844 wrote to memory of 2716 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 28 PID 1844 wrote to memory of 2716 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 28 PID 1844 wrote to memory of 2716 1844 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe"C:\Users\Admin\AppData\Local\Temp\62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\yaukin.exe"C:\Users\Admin\yaukin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD57212d17e139e5edeaa97b3419b3ef066
SHA1caa33832c4cce6e04c1ae4d58eae165029b2e855
SHA2560cb7779696e291a574059db0c0ca890e7032e7ee56a1f357df2a1794a645de0e
SHA51216ede06bba155690c545499d4a82e9f4a372f60853790d7ac94ee95090dfb1faf43cb9e72602cab0c3e66910ad8963121976f543d791e6792441a90e02344695