Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
198s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe
-
Size
160KB
-
MD5
849a41180540081165edc969b9ae7ea0
-
SHA1
aeca71635d7717d0e5109abe5f88f1eec6892c32
-
SHA256
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287
-
SHA512
0c7b8710a1f2bee1858bc13e337874794aed8e4fb424b599cabc97dc0c8a15a769e59317106f6b3073c99350574682ebc949faf475892fa89b92e1a72704bf34
-
SSDEEP
1536:x6pK+M/0iv0pBdQrAa/sOf5MFzF0K1/lex4vbLDuumW9I3iYIcdmAhjiKs:x53OOAa/lAFZbLymAFiKs
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woues.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe -
Executes dropped EXE 1 IoCs
pid Process 1756 woues.exe -
Loads dropped DLL 2 IoCs
pid Process 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /j" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /g" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /c" 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /l" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /f" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /b" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /z" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /a" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /n" woues.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /d" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /v" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /c" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /w" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /i" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /e" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /s" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /x" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /m" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /r" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /h" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /t" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /k" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /o" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /p" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /u" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /q" woues.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\woues = "C:\\Users\\Admin\\woues.exe /y" woues.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe 1756 woues.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 1756 woues.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1756 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 27 PID 1980 wrote to memory of 1756 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 27 PID 1980 wrote to memory of 1756 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 27 PID 1980 wrote to memory of 1756 1980 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe"C:\Users\Admin\AppData\Local\Temp\0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\woues.exe"C:\Users\Admin\woues.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1756
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD55b1ddecd7c365febe64ce7622dbe54b4
SHA170fc34ebf5963596034a4c1c0eed91d29914c42d
SHA256f25fc3884b0aa02093b44ba6da87a00e36ed92014e66d02414b152238dab2092
SHA512a55e12ca326e78532e2672ca04c1519b9264f37c26861498436f2853513812350c53fbcabc81d7ca5c810d2b2ffb3f0c1f3ad8aac508630dfb4b7460016a92dc
-
Filesize
160KB
MD55b1ddecd7c365febe64ce7622dbe54b4
SHA170fc34ebf5963596034a4c1c0eed91d29914c42d
SHA256f25fc3884b0aa02093b44ba6da87a00e36ed92014e66d02414b152238dab2092
SHA512a55e12ca326e78532e2672ca04c1519b9264f37c26861498436f2853513812350c53fbcabc81d7ca5c810d2b2ffb3f0c1f3ad8aac508630dfb4b7460016a92dc
-
Filesize
160KB
MD55b1ddecd7c365febe64ce7622dbe54b4
SHA170fc34ebf5963596034a4c1c0eed91d29914c42d
SHA256f25fc3884b0aa02093b44ba6da87a00e36ed92014e66d02414b152238dab2092
SHA512a55e12ca326e78532e2672ca04c1519b9264f37c26861498436f2853513812350c53fbcabc81d7ca5c810d2b2ffb3f0c1f3ad8aac508630dfb4b7460016a92dc
-
Filesize
160KB
MD55b1ddecd7c365febe64ce7622dbe54b4
SHA170fc34ebf5963596034a4c1c0eed91d29914c42d
SHA256f25fc3884b0aa02093b44ba6da87a00e36ed92014e66d02414b152238dab2092
SHA512a55e12ca326e78532e2672ca04c1519b9264f37c26861498436f2853513812350c53fbcabc81d7ca5c810d2b2ffb3f0c1f3ad8aac508630dfb4b7460016a92dc