Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
223s -
max time network
219s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
01/02/2025, 07:14
Behavioral task
behavioral1
Sample
ka.exe
Resource
win10ltsc2021-20250128-en
General
-
Target
ka.exe
-
Size
1.3MB
-
MD5
2e0827867a5d6d443f13b5734bb34f25
-
SHA1
abc9c26b88bf37571dcb342a89d6c185dab72062
-
SHA256
19e5abfc57e4969d264f332ccfd5d3f66fd288169e96acf40b6268f8e224ba77
-
SHA512
0d07a3ad39f143688d032088b970c199cf8015622c75290191c2370c5721204d545ac214cca56d2cf532e61f2550d15606cd389e0457e7480866f4df6f320967
-
SSDEEP
24576:WXT4A/dXgFI65Ux5PYgMBLVYyLJDI8kz5/gtY6v/87xaVUhffpE0vwYBb:WXMA1XgF06gGLVYuJDI8kz5YtY6WhfW6
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell and hide display window.
pid Process 356 powershell.exe 756 powershell.exe 3512 powershell.exe 4056 powershell.exe 3812 powershell.exe 4816 powershell.exe 972 powershell.exe 3768 powershell.exe 1152 powershell.exe 1424 powershell.exe -
Creates new service(s) 2 TTPs
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts ka.exe File opened for modification C:\Windows\System32\drivers\etc\hosts ka.exe -
Stops running service(s) 4 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WsHosts = "C:\\Windows\\WindowsUpdate\\wshosts.exe" ka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WsHosts = "C:\\Windows\\WindowsUpdate\\wshosts.exe" ka.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\WindowsUpdate\wshosts.exe ka.exe File created C:\Windows\WindowsUpdate\wshosts.exe ka.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4064 sc.exe 3204 sc.exe 2076 sc.exe 3660 sc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 356 powershell.exe 3768 powershell.exe 356 powershell.exe 1152 powershell.exe 1424 powershell.exe 3512 powershell.exe 756 powershell.exe 4056 powershell.exe 756 powershell.exe 3812 powershell.exe 4816 powershell.exe 972 powershell.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 356 powershell.exe Token: SeDebugPrivilege 3768 powershell.exe Token: SeDebugPrivilege 1152 powershell.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 3512 powershell.exe Token: SeDebugPrivilege 756 powershell.exe Token: SeDebugPrivilege 4056 powershell.exe Token: SeDebugPrivilege 3812 powershell.exe Token: SeDebugPrivilege 4816 powershell.exe Token: SeDebugPrivilege 972 powershell.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 228 wrote to memory of 356 228 ka.exe 80 PID 228 wrote to memory of 356 228 ka.exe 80 PID 228 wrote to memory of 3204 228 ka.exe 81 PID 228 wrote to memory of 3204 228 ka.exe 81 PID 228 wrote to memory of 3768 228 ka.exe 82 PID 228 wrote to memory of 3768 228 ka.exe 82 PID 228 wrote to memory of 1152 228 ka.exe 83 PID 228 wrote to memory of 1152 228 ka.exe 83 PID 228 wrote to memory of 1424 228 ka.exe 84 PID 228 wrote to memory of 1424 228 ka.exe 84 PID 228 wrote to memory of 3512 228 ka.exe 85 PID 228 wrote to memory of 3512 228 ka.exe 85 PID 228 wrote to memory of 2076 228 ka.exe 86 PID 228 wrote to memory of 2076 228 ka.exe 86 PID 1960 wrote to memory of 3652 1960 cmd.exe 101 PID 1960 wrote to memory of 3652 1960 cmd.exe 101 PID 3652 wrote to memory of 756 3652 ka.exe 102 PID 3652 wrote to memory of 756 3652 ka.exe 102 PID 3652 wrote to memory of 3660 3652 ka.exe 103 PID 3652 wrote to memory of 3660 3652 ka.exe 103 PID 3652 wrote to memory of 4056 3652 ka.exe 104 PID 3652 wrote to memory of 4056 3652 ka.exe 104 PID 3652 wrote to memory of 3812 3652 ka.exe 105 PID 3652 wrote to memory of 3812 3652 ka.exe 105 PID 3652 wrote to memory of 4816 3652 ka.exe 106 PID 3652 wrote to memory of 4816 3652 ka.exe 106 PID 3652 wrote to memory of 972 3652 ka.exe 107 PID 3652 wrote to memory of 972 3652 ka.exe 107 PID 3652 wrote to memory of 4064 3652 ka.exe 108 PID 3652 wrote to memory of 4064 3652 ka.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ka.exe"C:\Users\Admin\AppData\Local\Temp\ka.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Windows\WindowsUpdate\557950\st.ps1\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:356
-
-
C:\Windows\system32\sc.exe"sc" create WsHosts "binPath= \"C:\Users\Admin\AppData\Local\Temp\ka.exe\"" "start= auto"2⤵
- Launches sc.exe
PID:3204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\temp.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\svhosts.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\WindowsUpdate.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\wins32bugfix.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Windows\system32\sc.exe"sc" delete WsHosts2⤵
- Launches sc.exe
PID:2076
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2196
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\ka.exeC:\Users\Admin\AppData\Local\Temp\ka.exe2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Windows\WindowsUpdate\155944\st.ps1\""3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\system32\sc.exe"sc" create WsHosts "binPath= \"C:\Users\Admin\AppData\Local\Temp\ka.exe\"" "start= auto"3⤵
- Launches sc.exe
PID:3660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\temp.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\svhosts.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\WindowsUpdate.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File C:\Windows\System32\wins32bugfix.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Windows\system32\sc.exe"sc" delete WsHosts3⤵
- Launches sc.exe
PID:4064
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a94e0a262fe8ab5c0ec0872d36fcbd48
SHA1877a5ed6269746fe8827f715ef95136ea81c5374
SHA2564e689eb0bbeab4759a79c590a4d06d520a12974cf6cb79753832a5582a1ff0c9
SHA51292a1ebcb2e4e4279e6cb0ff9407ba363ecb27c47b8cd4441655d9ecf811b990d066856f4738f23f8d9b12d1f3d0de75ef6a101fed056f5392e7140111550ca54
-
Filesize
944B
MD5ad1581c64934c8b00a5c4f9a3685a2b5
SHA16b178e817d878eab54441c9852d88c0ea63be414
SHA256b9e99eba07099c0847b2a56f5eb65b243b6af79a279f20204a8c5febe9a2ccfb
SHA5121569b36aff2b88f23049463075c351a6afcc10bee1e62d996e18251b4efa4c8e8a37be7e63c7a057c971b7bc529620f87985c2c6bb89e2d459e52673b5baabec
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
944B
MD5bc8de92886bf66a25e19b2e14871ace4
SHA115339ed715170ed5dacbefe6ceb1c7cc68c95a34
SHA2560ebfe31c9689d5eeb4c74ee168f59c820bea93f313ba31fcbbeef18cffe4ab8d
SHA5127244e93e273e5f7b25e4a56378bb49c11fbffbdf97d150e218b4df8fdbcc46890726cec01a029378a6a1076c282c6a2fadfc7df4c2c792228cd70d2ea2370a55
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD5dec29dcc5fba036816e7fe130a30af9e
SHA191796cf55a57676dcaeb2564984ca0b6b9ccc8f6
SHA2561b8b2924aa7d00598a11c437f2c43e8deb9b138249e15b7ac6783baf810ecdcd
SHA512833ae7d1af9926706023c8a942e2e8dd51d022dbcf14b59e7f8cfad02174323fde9f95a355b61982050068731584f267704ae4324d5901981e1d53d2019fc3fc