Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe
-
Size
264KB
-
MD5
07d684e8e1fcf422c948e77e7dcbdc01
-
SHA1
701593e6bd07e43847801262d31bfc3a89445c71
-
SHA256
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598
-
SHA512
d669e8b16a8e4dddf02d5f06b5604790ff679e0c5a3b6e08a33d30a29eefc342432de895ee18f50295463db928f583f8472e0c932fcbe7b47b3776fbfeeef445
-
SSDEEP
6144:3FZiZ40OqFNLVJ6S0lE+6LVjlWPuEwTIwMe/wwUQO:3zGNhNLVJ/nLVjlWPuEwc
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" poanaf.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe -
Executes dropped EXE 1 IoCs
pid Process 1768 poanaf.exe -
Loads dropped DLL 2 IoCs
pid Process 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe -
Adds Run key to start application 2 TTPs 57 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /u" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /f" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /b" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /b" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /m" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /o" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /u" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /g" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /o" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /s" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /h" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /k" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /r" poanaf.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /j" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /e" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /p" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /c" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /p" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /q" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /r" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /n" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /x" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /h" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /y" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /l" 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /l" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /d" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /v" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /a" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /a" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /z" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /q" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /y" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /t" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /s" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /a" 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /z" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /m" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /k" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /e" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /f" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /l" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /w" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /c" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /i" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /v" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /g" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /d" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /w" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /x" poanaf.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /i" poanaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /j" poanaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\poanaf = "C:\\Users\\Admin\\poanaf.exe /t" poanaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe 1768 poanaf.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1768 poanaf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 1768 poanaf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1828 wrote to memory of 1768 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 27 PID 1828 wrote to memory of 1768 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 27 PID 1828 wrote to memory of 1768 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 27 PID 1828 wrote to memory of 1768 1828 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe"C:\Users\Admin\AppData\Local\Temp\36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\poanaf.exe"C:\Users\Admin\poanaf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1768
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD57f2e787b113d28a878d9fd142c2dd126
SHA1b4ff792c9a9107535496c24fba1fb12576edace4
SHA256a46f96d70fbe549046830a889aa9fdd0d9f98ceafe6ecf14f79cc6ba5409210b
SHA512d37eeaa3b93378838b3cc145d8a298e43d70c94004d93317ba9c84a90d7592eb9ef42c5f10e6ac914f2b1537fadb63916658722f44eaaf1c711996ab5745e382
-
Filesize
264KB
MD57f2e787b113d28a878d9fd142c2dd126
SHA1b4ff792c9a9107535496c24fba1fb12576edace4
SHA256a46f96d70fbe549046830a889aa9fdd0d9f98ceafe6ecf14f79cc6ba5409210b
SHA512d37eeaa3b93378838b3cc145d8a298e43d70c94004d93317ba9c84a90d7592eb9ef42c5f10e6ac914f2b1537fadb63916658722f44eaaf1c711996ab5745e382
-
Filesize
264KB
MD57f2e787b113d28a878d9fd142c2dd126
SHA1b4ff792c9a9107535496c24fba1fb12576edace4
SHA256a46f96d70fbe549046830a889aa9fdd0d9f98ceafe6ecf14f79cc6ba5409210b
SHA512d37eeaa3b93378838b3cc145d8a298e43d70c94004d93317ba9c84a90d7592eb9ef42c5f10e6ac914f2b1537fadb63916658722f44eaaf1c711996ab5745e382
-
Filesize
264KB
MD57f2e787b113d28a878d9fd142c2dd126
SHA1b4ff792c9a9107535496c24fba1fb12576edace4
SHA256a46f96d70fbe549046830a889aa9fdd0d9f98ceafe6ecf14f79cc6ba5409210b
SHA512d37eeaa3b93378838b3cc145d8a298e43d70c94004d93317ba9c84a90d7592eb9ef42c5f10e6ac914f2b1537fadb63916658722f44eaaf1c711996ab5745e382