Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe
-
Size
224KB
-
MD5
6073b3c96cae6b13626e36fecf7d9ff8
-
SHA1
b2f6bf864409f12b222d43449498b187528d0ed2
-
SHA256
89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913
-
SHA512
38ef3e8371f95a4ee08def6ce3b53ac5ff322f1a01f66fcc8a60a09bbb7f2fad1f82c69e264ec3dd25bbc36e915f80bb3dc2cfd667abda4144b1296249497641
-
SSDEEP
3072:0XyqNsMoBum30jZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUba9:LqN5hp4LnbmlrZW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" juuut.exe -
Executes dropped EXE 1 IoCs
pid Process 1492 juuut.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /e" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /m" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /o" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /q" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /z" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /r" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /g" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /i" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /k" juuut.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /w" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /v" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /b" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /s" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /t" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /u" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /p" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /l" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /a" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /j" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /b" 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /c" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /x" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /n" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /f" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /d" juuut.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /y" juuut.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\juuut = "C:\\Users\\Admin\\juuut.exe /h" juuut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe 4920 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe 1492 juuut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4920 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe 1492 juuut.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1492 4920 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe 90 PID 4920 wrote to memory of 1492 4920 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe 90 PID 4920 wrote to memory of 1492 4920 89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe"C:\Users\Admin\AppData\Local\Temp\89830eef5fd5cb2b2bbdf48bd43c37d5479eaa938f0015e561dda18c9223e913.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\juuut.exe"C:\Users\Admin\juuut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1492
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD532454c997c9c8488798a59d08e302d97
SHA1e44838ad8d816785b4d08adfe7b24bfc410f6504
SHA2563a30a73e5ed941c0fa4e53ed8c14f29671d250ff28a994441c2a827635ba046d
SHA5121cb67ebb83c82ad54c59d39262dc544f7375a9e26f0e71217cf6b7faae243393ef1bdad3c056a80cdc9f2f73da90205f7d0c53c9a15dc84852342da1b08c1a3b
-
Filesize
224KB
MD532454c997c9c8488798a59d08e302d97
SHA1e44838ad8d816785b4d08adfe7b24bfc410f6504
SHA2563a30a73e5ed941c0fa4e53ed8c14f29671d250ff28a994441c2a827635ba046d
SHA5121cb67ebb83c82ad54c59d39262dc544f7375a9e26f0e71217cf6b7faae243393ef1bdad3c056a80cdc9f2f73da90205f7d0c53c9a15dc84852342da1b08c1a3b