Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe
-
Size
104KB
-
MD5
6b3fc93e3db0663640ae3abe6766dcbe
-
SHA1
7dfd4c6735db9519a65d8bbb9120673eb0496035
-
SHA256
5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41
-
SHA512
d93d898e4369aa28f44c6fc9e80ac38d9d3979e3895c5d9a99cd9b263aff0e83de807f68e301a0973c4ac6e94530550b51c5d3025ba534fa6665b28a3506c762
-
SSDEEP
1536:j6CHOOMyRIKOrKTgoV5d3s6wUinu9u3okkBwKCe/LiwKCel:7HOOMyRI7kgoLd3H9xeokkBwI/LiwIl
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\tb.ico 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe File created C:\WINDOWS\SysWOW64\dy.ico 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\vb.ini 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell\open 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JJE\DefaultIcon 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE http://www.xuntao.info" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JJE\shell\open 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JJE\DefaultIcon\ = "C:\\WINDOWS\\SysWow64\\dy.ico" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JJE\shell\open\command 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.SE\ = "IE" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.JE 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE\DefaultIcon 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell\open\command 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.JJE 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\ = "¿ì½Ý·½Ê½" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JJE 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.SE 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE http://dh.web768.com?1143811" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.JE\ = "JE" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage\Command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE http://dh.web768.com?1143811" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\DefaultIcon 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage\Command 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.JJE\ = "JJE" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JJE\ = "¿ì½Ý·½Ê½" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JJE\shell 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\shell\open\command 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JE\ = "¿ì½Ý·½Ê½" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JE\DefaultIcon\ = "C:\\WINDOWS\\SysWow64\\tb.ico" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JE\shell 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JJE\shell\open\command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE http://dy.dy213.com" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}\shell\OpenHomePage\ = "´ò¿ªÖ÷Ò³(&O)" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IE\DefaultIcon\ = "shdoclc.dll,0" 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe Token: SeDebugPrivilege 3372 5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe"C:\Users\Admin\AppData\Local\Temp\5f0dfac841bb89908d138bc3eea8634738362ca8003524e2e4e81c9807ae4f41.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372