Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe
-
Size
264KB
-
MD5
07d684e8e1fcf422c948e77e7dcbdc01
-
SHA1
701593e6bd07e43847801262d31bfc3a89445c71
-
SHA256
36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598
-
SHA512
d669e8b16a8e4dddf02d5f06b5604790ff679e0c5a3b6e08a33d30a29eefc342432de895ee18f50295463db928f583f8472e0c932fcbe7b47b3776fbfeeef445
-
SSDEEP
6144:3FZiZ40OqFNLVJ6S0lE+6LVjlWPuEwTIwMe/wwUQO:3zGNhNLVJ/nLVjlWPuEwc
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hgnid.exe -
Executes dropped EXE 1 IoCs
pid Process 3884 hgnid.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe -
Adds Run key to start application 2 TTPs 58 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /i" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /c" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /k" hgnid.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /p" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /m" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /n" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /h" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /z" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /v" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /k" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /q" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /k" 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /t" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /a" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /w" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /s" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /u" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /b" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /g" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /v" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /q" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /p" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /a" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /f" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /r" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /d" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /g" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /s" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /c" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /b" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /x" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /h" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /z" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /n" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /y" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /k" 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /d" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /o" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /l" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /y" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /o" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /e" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /j" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /e" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /l" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /x" hgnid.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /m" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /f" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /t" hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /i" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /j" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /r" hgnid.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ hgnid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /w" hgnid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgnid = "C:\\Users\\Admin\\hgnid.exe /u" hgnid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3160 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 3160 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe 3884 hgnid.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3884 hgnid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3160 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 3884 hgnid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3160 wrote to memory of 3884 3160 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 80 PID 3160 wrote to memory of 3884 3160 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 80 PID 3160 wrote to memory of 3884 3160 36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe"C:\Users\Admin\AppData\Local\Temp\36e45be41b2e6cf8b3fae60bc70fcb736c2ea42def40fb7bfddfa668a4b9f598.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\hgnid.exe"C:\Users\Admin\hgnid.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3884
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD53e95ecbbee67b8a7da572dd1a65ae198
SHA15f022030b42007f1c2e78c62028da823ecf64c7c
SHA256505aba998182e14d4f23e6814025a22eb3fa3a36431a5af7e6ca2c7c3505d77a
SHA512d61e1920d53804eea9819246be6df436b46ab8518a3cadf022df4315d3a867dc8197d97a4f383db6b07c791a0da60cf96a2f6e16e407a8aa9270ce3207c4b9c5
-
Filesize
264KB
MD53e95ecbbee67b8a7da572dd1a65ae198
SHA15f022030b42007f1c2e78c62028da823ecf64c7c
SHA256505aba998182e14d4f23e6814025a22eb3fa3a36431a5af7e6ca2c7c3505d77a
SHA512d61e1920d53804eea9819246be6df436b46ab8518a3cadf022df4315d3a867dc8197d97a4f383db6b07c791a0da60cf96a2f6e16e407a8aa9270ce3207c4b9c5