Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2025, 08:56 UTC

General

  • Target

    792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe

  • Size

    994KB

  • MD5

    f751a2295024cb156e021fee9c86df40

  • SHA1

    a0cee6ec85b8a3d13e002a42424a7076748dff20

  • SHA256

    792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8c

  • SHA512

    38dafa748a3d9b14a070f63b100975702012cdcf78d83d12af6e2bf0eb809b98ed1be5926c836dafb433bc1df22fdeb0f6f79017dda2fbdccdf08df8733c9f30

  • SSDEEP

    24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxe:7J5gEKNikf3hBfUiWxe

Malware Config

Signatures

  • Ammyy Admin

    Remote admin tool with various capabilities.

  • AmmyyAdmin payload 1 IoCs
  • Ammyyadmin family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe
    "C:\Users\Admin\AppData\Local\Temp\792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3064

Network

  • flag-us
    DNS
    maitikio.com
    budha.exe
    Remote address:
    8.8.8.8:53
    Request
    maitikio.com
    IN A
    Response
  • flag-us
    DNS
    cry-havok.org
    budha.exe
    Remote address:
    8.8.8.8:53
    Request
    cry-havok.org
    IN A
    Response
    cry-havok.org
    IN A
    15.197.148.33
    cry-havok.org
    IN A
    3.33.130.190
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    780 B
    4.6kB
    10
    10
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    734 B
    4.5kB
    9
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    tls
    budha.exe
    682 B
    4.5kB
    8
    9
  • 15.197.148.33:443
    cry-havok.org
    budha.exe
    52 B
    1
  • 8.8.8.8:53
    maitikio.com
    dns
    budha.exe
    58 B
    131 B
    1
    1

    DNS Request

    maitikio.com

  • 8.8.8.8:53
    cry-havok.org
    dns
    budha.exe
    59 B
    91 B
    1
    1

    DNS Request

    cry-havok.org

    DNS Response

    15.197.148.33
    3.33.130.190

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabEF41.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarEF63.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    995KB

    MD5

    d47c1c65f2260a357cc834c4150a9e09

    SHA1

    7a64d7974a5c5682cfa265d1c8e7442001ea2ded

    SHA256

    0de37722827109ab756f8d6b02a059b652b5dd00832e06d476ed500bfcc6e72e

    SHA512

    a239eb0dc9b40a31d7df77fd95500f50b3fd9fe9a325ea32542f6c49498501e213e1573ecc858617bb2a2117d3452205ceab37a01d645c9630fa21a83be22a83

  • memory/2084-0-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2084-1-0x0000000001E10000-0x0000000001E11000-memory.dmp

    Filesize

    4KB

  • memory/2084-3-0x0000000002B70000-0x0000000002F70000-memory.dmp

    Filesize

    4.0MB

  • memory/2084-10-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/2084-8-0x0000000003360000-0x0000000003370000-memory.dmp

    Filesize

    64KB

  • memory/3064-11-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/3064-14-0x0000000002AF0000-0x0000000002EF0000-memory.dmp

    Filesize

    4.0MB

  • memory/3064-13-0x0000000001F30000-0x0000000001F31000-memory.dmp

    Filesize

    4KB

  • memory/3064-49-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.