Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 21:48
Static task
static1
Behavioral task
behavioral1
Sample
1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe
-
Size
312KB
-
MD5
095f627782dbaab51a5ebb47f73bf396
-
SHA1
490bcb298e1fd5151f9054e1bb2d4263a86eee8b
-
SHA256
1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad
-
SHA512
02d363308fbad94bd97c8ba3dd99ce45ec8c2086bbf9671a05e51bd7b1b495697b0808e7b9605d4847f192d68a9a21d37086a8ce3fb0331465b9b6e86f69686f
-
SSDEEP
6144:pZXePAnwXgYIlqAnIVDC8e5uMSXGJZPBP3Jm90GF8:CowXgYMNIVa5uM1D/U0s8
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xeuku.exe -
Executes dropped EXE 1 IoCs
pid Process 808 xeuku.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /k" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /G" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /H" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /w" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /c" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /C" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /b" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /F" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /g" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /N" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /J" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /Y" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /S" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /E" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /L" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /e" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /x" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /B" 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /f" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /u" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /j" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /h" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /R" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /p" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /V" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /z" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /O" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /t" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /d" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /i" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /a" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /I" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /B" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /D" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /M" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /P" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /W" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /Q" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /v" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /s" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /Z" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /q" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /l" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /y" xeuku.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /K" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /T" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /X" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /o" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /U" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /r" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /m" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /n" xeuku.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xeuku = "C:\\Users\\Admin\\xeuku.exe /A" xeuku.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4880 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe 4880 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe 808 xeuku.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4880 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe 808 xeuku.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4880 wrote to memory of 808 4880 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe 82 PID 4880 wrote to memory of 808 4880 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe 82 PID 4880 wrote to memory of 808 4880 1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe"C:\Users\Admin\AppData\Local\Temp\1d4f39c856cb7ea9ec2d47ce51c9a341e19b9079ac7095adc68c00bfa129d3ad.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\xeuku.exe"C:\Users\Admin\xeuku.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:808
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD57b52061e403820cbb430d95ca56cd2c0
SHA1fb6b368b781df752305bb19e22059b8daefa983e
SHA256539629379b3bc3e770280ee3cfc77648b4a5770b9a3493c1e1091bfbdd964f4c
SHA512ba8d1de0ee55cd4e94bdd5111aa9b1f4dad2d66f4a33de646e8b4ce269006c3c09829639e7e3798d7dcbcf3295b38aa9777333f78949fbf8ad8274f381cedb1b
-
Filesize
312KB
MD57b52061e403820cbb430d95ca56cd2c0
SHA1fb6b368b781df752305bb19e22059b8daefa983e
SHA256539629379b3bc3e770280ee3cfc77648b4a5770b9a3493c1e1091bfbdd964f4c
SHA512ba8d1de0ee55cd4e94bdd5111aa9b1f4dad2d66f4a33de646e8b4ce269006c3c09829639e7e3798d7dcbcf3295b38aa9777333f78949fbf8ad8274f381cedb1b