Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/02/2025, 07:14

250201-h2xtnawjcq 10

01/02/2025, 06:19

250201-g3g9xsvlap 10

Analysis

  • max time kernel
    223s
  • max time network
    219s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250128-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    01/02/2025, 07:14

General

  • Target

    ka.exe

  • Size

    1.3MB

  • MD5

    2e0827867a5d6d443f13b5734bb34f25

  • SHA1

    abc9c26b88bf37571dcb342a89d6c185dab72062

  • SHA256

    19e5abfc57e4969d264f332ccfd5d3f66fd288169e96acf40b6268f8e224ba77

  • SHA512

    0d07a3ad39f143688d032088b970c199cf8015622c75290191c2370c5721204d545ac214cca56d2cf532e61f2550d15606cd389e0457e7480866f4df6f320967

  • SSDEEP

    24576:WXT4A/dXgFI65Ux5PYgMBLVYyLJDI8kz5/gtY6v/87xaVUhffpE0vwYBb:WXMA1XgF06gGLVYuJDI8kz5YtY6WhfW6

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell and hide display window.

  • Creates new service(s) 2 TTPs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ka.exe
    "C:\Users\Admin\AppData\Local\Temp\ka.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Windows\WindowsUpdate\557950\st.ps1\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:356
    • C:\Windows\system32\sc.exe
      "sc" create WsHosts "binPath= \"C:\Users\Admin\AppData\Local\Temp\ka.exe\"" "start= auto"
      2⤵
      • Launches sc.exe
      PID:3204
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\temp.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3768
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\svhosts.ps1
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1152
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\WindowsUpdate.ps1
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1424
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\wins32bugfix.ps1
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3512
    • C:\Windows\system32\sc.exe
      "sc" delete WsHosts
      2⤵
      • Launches sc.exe
      PID:2076
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2196
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Users\Admin\AppData\Local\Temp\ka.exe
        C:\Users\Admin\AppData\Local\Temp\ka.exe
        2⤵
        • Drops file in Drivers directory
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" "-WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Windows\WindowsUpdate\155944\st.ps1\""
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:756
        • C:\Windows\system32\sc.exe
          "sc" create WsHosts "binPath= \"C:\Users\Admin\AppData\Local\Temp\ka.exe\"" "start= auto"
          3⤵
          • Launches sc.exe
          PID:3660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\temp.ps1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4056
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\svhosts.ps1
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\WindowsUpdate.ps1
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4816
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\wins32bugfix.ps1
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:972
        • C:\Windows\system32\sc.exe
          "sc" delete WsHosts
          3⤵
          • Launches sc.exe
          PID:4064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      1KB

      MD5

      a94e0a262fe8ab5c0ec0872d36fcbd48

      SHA1

      877a5ed6269746fe8827f715ef95136ea81c5374

      SHA256

      4e689eb0bbeab4759a79c590a4d06d520a12974cf6cb79753832a5582a1ff0c9

      SHA512

      92a1ebcb2e4e4279e6cb0ff9407ba363ecb27c47b8cd4441655d9ecf811b990d066856f4738f23f8d9b12d1f3d0de75ef6a101fed056f5392e7140111550ca54

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      ad1581c64934c8b00a5c4f9a3685a2b5

      SHA1

      6b178e817d878eab54441c9852d88c0ea63be414

      SHA256

      b9e99eba07099c0847b2a56f5eb65b243b6af79a279f20204a8c5febe9a2ccfb

      SHA512

      1569b36aff2b88f23049463075c351a6afcc10bee1e62d996e18251b4efa4c8e8a37be7e63c7a057c971b7bc529620f87985c2c6bb89e2d459e52673b5baabec

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      64B

      MD5

      446dd1cf97eaba21cf14d03aebc79f27

      SHA1

      36e4cc7367e0c7b40f4a8ace272941ea46373799

      SHA256

      a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

      SHA512

      a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      944B

      MD5

      bc8de92886bf66a25e19b2e14871ace4

      SHA1

      15339ed715170ed5dacbefe6ceb1c7cc68c95a34

      SHA256

      0ebfe31c9689d5eeb4c74ee168f59c820bea93f313ba31fcbbeef18cffe4ab8d

      SHA512

      7244e93e273e5f7b25e4a56378bb49c11fbffbdf97d150e218b4df8fdbcc46890726cec01a029378a6a1076c282c6a2fadfc7df4c2c792228cd70d2ea2370a55

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lnv15i5x.2is.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Windows\System32\drivers\etc\hosts

      Filesize

      2KB

      MD5

      dec29dcc5fba036816e7fe130a30af9e

      SHA1

      91796cf55a57676dcaeb2564984ca0b6b9ccc8f6

      SHA256

      1b8b2924aa7d00598a11c437f2c43e8deb9b138249e15b7ac6783baf810ecdcd

      SHA512

      833ae7d1af9926706023c8a942e2e8dd51d022dbcf14b59e7f8cfad02174323fde9f95a355b61982050068731584f267704ae4324d5901981e1d53d2019fc3fc

    • memory/228-81-0x00007FF710A80000-0x00007FF710B76000-memory.dmp

      Filesize

      984KB

    • memory/356-27-0x00007FFAEFEB0000-0x00007FFAF0972000-memory.dmp

      Filesize

      10.8MB

    • memory/356-35-0x00007FFAEFEB0000-0x00007FFAF0972000-memory.dmp

      Filesize

      10.8MB

    • memory/356-34-0x00007FFAEFEB0000-0x00007FFAF0972000-memory.dmp

      Filesize

      10.8MB

    • memory/356-51-0x00007FFAEFEB0000-0x00007FFAF0972000-memory.dmp

      Filesize

      10.8MB

    • memory/356-6-0x00007FFAEFEB3000-0x00007FFAEFEB5000-memory.dmp

      Filesize

      8KB

    • memory/356-26-0x00007FFAEFEB0000-0x00007FFAF0972000-memory.dmp

      Filesize

      10.8MB

    • memory/3652-155-0x00007FF710A80000-0x00007FF710B76000-memory.dmp

      Filesize

      984KB

    • memory/3768-32-0x00007FFAEFEB0000-0x00007FFAF0972000-memory.dmp

      Filesize

      10.8MB

    • memory/3768-82-0x00007FFAEFEB0000-0x00007FFAF0972000-memory.dmp

      Filesize

      10.8MB

    • memory/3768-24-0x000002836ACB0000-0x000002836ACD2000-memory.dmp

      Filesize

      136KB