Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 08:56
Behavioral task
behavioral1
Sample
792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe
Resource
win10v2004-20241007-en
General
-
Target
792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe
-
Size
994KB
-
MD5
f751a2295024cb156e021fee9c86df40
-
SHA1
a0cee6ec85b8a3d13e002a42424a7076748dff20
-
SHA256
792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8c
-
SHA512
38dafa748a3d9b14a070f63b100975702012cdcf78d83d12af6e2bf0eb809b98ed1be5926c836dafb433bc1df22fdeb0f6f79017dda2fbdccdf08df8733c9f30
-
SSDEEP
24576:+MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsxe:7J5gEKNikf3hBfUiWxe
Malware Config
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000012117-5.dat family_ammyyadmin -
Ammyyadmin family
-
Executes dropped EXE 1 IoCs
pid Process 3064 budha.exe -
Loads dropped DLL 1 IoCs
pid Process 2084 792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe -
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0007000000012117-5.dat upx behavioral1/memory/2084-10-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/3064-11-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/3064-49-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language budha.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 3064 2084 792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe 31 PID 2084 wrote to memory of 3064 2084 792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe 31 PID 2084 wrote to memory of 3064 2084 792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe 31 PID 2084 wrote to memory of 3064 2084 792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe"C:\Users\Admin\AppData\Local\Temp\792073e71988f07d1c352ccc9c5c96a89459e5af2c935202abe1ca423cc80f8cN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\budha.exe"C:\Users\Admin\AppData\Local\Temp\budha.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
995KB
MD5d47c1c65f2260a357cc834c4150a9e09
SHA17a64d7974a5c5682cfa265d1c8e7442001ea2ded
SHA2560de37722827109ab756f8d6b02a059b652b5dd00832e06d476ed500bfcc6e72e
SHA512a239eb0dc9b40a31d7df77fd95500f50b3fd9fe9a325ea32542f6c49498501e213e1573ecc858617bb2a2117d3452205ceab37a01d645c9630fa21a83be22a83