Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe
-
Size
376KB
-
MD5
6eed63edacd4d685bbef8c719d8ec140
-
SHA1
cbb3187c53b254d105de3a0550cab149435392bc
-
SHA256
7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616
-
SHA512
64079d9605f6861a61040a630776f2f1fbd4822eb3e68c61cdf03a03a6dc2676df16245913022759a70e7c197f6f52032a444f58abf66706dbd0fd88de3e17b0
-
SSDEEP
6144:NECmVYD3gkWi9BaAbHOVSL7Qm61FC84m2YlK:0VYTwi9cAiSLT61wQs
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" naaobuz.exe -
Executes dropped EXE 1 IoCs
pid Process 948 naaobuz.exe -
Loads dropped DLL 2 IoCs
pid Process 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /Y" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /K" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /v" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /t" naaobuz.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /T" 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /f" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /Q" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /d" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /g" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /l" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /i" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /o" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /V" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /Z" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /T" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /D" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /x" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /N" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /X" naaobuz.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /n" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /p" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /L" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /s" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /m" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /w" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /r" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /h" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /S" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /M" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /W" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /O" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /B" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /u" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /C" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /b" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /j" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /z" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /A" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /E" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /c" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /q" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /y" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /G" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /a" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /H" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /F" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /R" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /P" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /U" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /e" naaobuz.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\naaobuz = "C:\\Users\\Admin\\naaobuz.exe /k" naaobuz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe 948 naaobuz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe 948 naaobuz.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1184 wrote to memory of 948 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe 27 PID 1184 wrote to memory of 948 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe 27 PID 1184 wrote to memory of 948 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe 27 PID 1184 wrote to memory of 948 1184 7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe"C:\Users\Admin\AppData\Local\Temp\7fa870371364123e05201c77e00d931d25f87dc127dfeff90adb152ebe8f5616.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\naaobuz.exe"C:\Users\Admin\naaobuz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD5a3b62dd66978616e32f5b0ae646f93b0
SHA1c82bd607664b58dcbd18a8b5f3b2da35910e65f6
SHA256848ae6dfb5fd2eebdd5e24149f68eb66047cb93fdda8ee91092676127b3f3329
SHA512ec675a608b0cee22f050671684ab988350d0f2edea02058320db487043c71511abfd113570373427419943e3c2e65631be45f4d66ff2cde9d2e4ce8768471dcb
-
Filesize
376KB
MD5a3b62dd66978616e32f5b0ae646f93b0
SHA1c82bd607664b58dcbd18a8b5f3b2da35910e65f6
SHA256848ae6dfb5fd2eebdd5e24149f68eb66047cb93fdda8ee91092676127b3f3329
SHA512ec675a608b0cee22f050671684ab988350d0f2edea02058320db487043c71511abfd113570373427419943e3c2e65631be45f4d66ff2cde9d2e4ce8768471dcb
-
Filesize
376KB
MD5a3b62dd66978616e32f5b0ae646f93b0
SHA1c82bd607664b58dcbd18a8b5f3b2da35910e65f6
SHA256848ae6dfb5fd2eebdd5e24149f68eb66047cb93fdda8ee91092676127b3f3329
SHA512ec675a608b0cee22f050671684ab988350d0f2edea02058320db487043c71511abfd113570373427419943e3c2e65631be45f4d66ff2cde9d2e4ce8768471dcb
-
Filesize
376KB
MD5a3b62dd66978616e32f5b0ae646f93b0
SHA1c82bd607664b58dcbd18a8b5f3b2da35910e65f6
SHA256848ae6dfb5fd2eebdd5e24149f68eb66047cb93fdda8ee91092676127b3f3329
SHA512ec675a608b0cee22f050671684ab988350d0f2edea02058320db487043c71511abfd113570373427419943e3c2e65631be45f4d66ff2cde9d2e4ce8768471dcb