Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe
-
Size
127KB
-
MD5
014d1a783d28a633bd596585e85c6eaa
-
SHA1
c8091d110bd978dd4cd120e9a8e6a36090bc8fb3
-
SHA256
370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89
-
SHA512
cec5803170e5b2da001eba689648c8cc0b27508f80ca5834a34054cc8364ffca8c2b7e5cd1b60298f8b574eb14f94c83218a97406250563e590f46d018b3aaf5
-
SSDEEP
3072:YYe5uwx7W/a7ju63Lq1OsYGSjf9jKj0Zy+VIP2jwSoSLk61PjqrSMAVuVH6qJn6Q:YL5VI/a7nOn7j7T
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" miaguu.exe -
Executes dropped EXE 1 IoCs
pid Process 892 miaguu.exe -
Loads dropped DLL 2 IoCs
pid Process 1080 370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe 1080 370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ miaguu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\miaguu = "C:\\Users\\Admin\\miaguu.exe" miaguu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe 892 miaguu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1080 370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe 892 miaguu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 892 1080 370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe 28 PID 1080 wrote to memory of 892 1080 370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe 28 PID 1080 wrote to memory of 892 1080 370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe 28 PID 1080 wrote to memory of 892 1080 370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe 28 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19 PID 892 wrote to memory of 1080 892 miaguu.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe"C:\Users\Admin\AppData\Local\Temp\370d2fb999efc14ec741ed52fdf56a993726862bbb06c099773a5dc09d062f89.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\miaguu.exe"C:\Users\Admin\miaguu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD569310dc98ff7b95195ac8fc04b096595
SHA15d3b78883348f217f4edaaaf9cdd2e843921738d
SHA2567b0fc8929884f61022c29e7ff94f9e5d00a1d1e5b4eafbf522e678a5a92c19db
SHA51270b2483e36f587f49e2bdae116a1396f9470ae784cc7704cd9438d6a6736b8d65776365c97f9a630215e161eb7af804bb18eec456013f599cedece3fe65ab216
-
Filesize
127KB
MD569310dc98ff7b95195ac8fc04b096595
SHA15d3b78883348f217f4edaaaf9cdd2e843921738d
SHA2567b0fc8929884f61022c29e7ff94f9e5d00a1d1e5b4eafbf522e678a5a92c19db
SHA51270b2483e36f587f49e2bdae116a1396f9470ae784cc7704cd9438d6a6736b8d65776365c97f9a630215e161eb7af804bb18eec456013f599cedece3fe65ab216
-
Filesize
127KB
MD569310dc98ff7b95195ac8fc04b096595
SHA15d3b78883348f217f4edaaaf9cdd2e843921738d
SHA2567b0fc8929884f61022c29e7ff94f9e5d00a1d1e5b4eafbf522e678a5a92c19db
SHA51270b2483e36f587f49e2bdae116a1396f9470ae784cc7704cd9438d6a6736b8d65776365c97f9a630215e161eb7af804bb18eec456013f599cedece3fe65ab216
-
Filesize
127KB
MD569310dc98ff7b95195ac8fc04b096595
SHA15d3b78883348f217f4edaaaf9cdd2e843921738d
SHA2567b0fc8929884f61022c29e7ff94f9e5d00a1d1e5b4eafbf522e678a5a92c19db
SHA51270b2483e36f587f49e2bdae116a1396f9470ae784cc7704cd9438d6a6736b8d65776365c97f9a630215e161eb7af804bb18eec456013f599cedece3fe65ab216