Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe
-
Size
200KB
-
MD5
6ddbadd4babbf063c08649f6152e4bc0
-
SHA1
70178f950810b161d82edbfa24b557b8ea5f8ad9
-
SHA256
0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5
-
SHA512
8fae19e9e3c79ae97577306526df0b7d3234ead4f4ad9c3c9a4cca897e518a35f145237879b16f800441066818301c3dbc83d91957d19ceb6e3e6e32ad692496
-
SSDEEP
6144:vmHL99ZpWymPBeaSAOJ+7xi5eRed63qaCR8nIBKu:OB9rLmPBeaSAOJ+7xi5eRed63qaCP
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hbseol.exe -
Executes dropped EXE 1 IoCs
pid Process 1504 hbseol.exe -
Loads dropped DLL 2 IoCs
pid Process 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /q" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /F" hbseol.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /d" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /u" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /z" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /V" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /U" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /t" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /G" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /x" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /B" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /E" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /L" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /A" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /g" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /H" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /K" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /R" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /D" hbseol.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /o" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /b" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /j" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /e" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /I" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /r" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /c" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /l" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /W" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /X" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /k" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /i" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /C" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /P" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /Y" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /O" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /M" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /m" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /v" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /J" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /f" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /S" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /N" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /n" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /a" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /Q" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /T" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /k" 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /y" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /Z" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /w" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /p" hbseol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\hbseol = "C:\\Users\\Admin\\hbseol.exe /s" hbseol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe 1504 hbseol.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe 1504 hbseol.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1504 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe 27 PID 1508 wrote to memory of 1504 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe 27 PID 1508 wrote to memory of 1504 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe 27 PID 1508 wrote to memory of 1504 1508 0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe"C:\Users\Admin\AppData\Local\Temp\0a80a7558bd730ca69322261be9508ecb32122d5661d85765298c5b5dd60bfa5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\hbseol.exe"C:\Users\Admin\hbseol.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1504
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5a938fa13d27769a03594227830056fd6
SHA1ccf9cd8a731e9ef0fe18983af52c702f5f56dbd5
SHA2562a4de86f1dea5c7dc7b8672c4eb1daae86ccf0d99f7f8b2da66751647a33772b
SHA5127a8656942af71f71365021ed6ab7062e422c661b36b46f26dae9eedd3e3d48365123289db19bb507146ee718d5d0321b3d8e2697678a96a9cab97445c7da9004
-
Filesize
200KB
MD5a938fa13d27769a03594227830056fd6
SHA1ccf9cd8a731e9ef0fe18983af52c702f5f56dbd5
SHA2562a4de86f1dea5c7dc7b8672c4eb1daae86ccf0d99f7f8b2da66751647a33772b
SHA5127a8656942af71f71365021ed6ab7062e422c661b36b46f26dae9eedd3e3d48365123289db19bb507146ee718d5d0321b3d8e2697678a96a9cab97445c7da9004
-
Filesize
200KB
MD5a938fa13d27769a03594227830056fd6
SHA1ccf9cd8a731e9ef0fe18983af52c702f5f56dbd5
SHA2562a4de86f1dea5c7dc7b8672c4eb1daae86ccf0d99f7f8b2da66751647a33772b
SHA5127a8656942af71f71365021ed6ab7062e422c661b36b46f26dae9eedd3e3d48365123289db19bb507146ee718d5d0321b3d8e2697678a96a9cab97445c7da9004
-
Filesize
200KB
MD5a938fa13d27769a03594227830056fd6
SHA1ccf9cd8a731e9ef0fe18983af52c702f5f56dbd5
SHA2562a4de86f1dea5c7dc7b8672c4eb1daae86ccf0d99f7f8b2da66751647a33772b
SHA5127a8656942af71f71365021ed6ab7062e422c661b36b46f26dae9eedd3e3d48365123289db19bb507146ee718d5d0321b3d8e2697678a96a9cab97445c7da9004