Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe
-
Size
160KB
-
MD5
849a41180540081165edc969b9ae7ea0
-
SHA1
aeca71635d7717d0e5109abe5f88f1eec6892c32
-
SHA256
0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287
-
SHA512
0c7b8710a1f2bee1858bc13e337874794aed8e4fb424b599cabc97dc0c8a15a769e59317106f6b3073c99350574682ebc949faf475892fa89b92e1a72704bf34
-
SSDEEP
1536:x6pK+M/0iv0pBdQrAa/sOf5MFzF0K1/lex4vbLDuumW9I3iYIcdmAhjiKs:x53OOAa/lAFZbLymAFiKs
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qiake.exe -
Executes dropped EXE 1 IoCs
pid Process 4076 qiake.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /k" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /j" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /x" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /u" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /q" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /f" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /s" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /l" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /c" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /t" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /h" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /e" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /v" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /o" qiake.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /i" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /d" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /p" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /n" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /g" 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /a" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /b" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /z" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /g" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /y" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /r" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /m" qiake.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qiake = "C:\\Users\\Admin\\qiake.exe /w" qiake.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4444 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 4444 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe 4076 qiake.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4444 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 4076 qiake.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4444 wrote to memory of 4076 4444 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 84 PID 4444 wrote to memory of 4076 4444 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 84 PID 4444 wrote to memory of 4076 4444 0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe"C:\Users\Admin\AppData\Local\Temp\0a4c1a5fd72c1b78df6faff0efc6e9a773a233c3768710a6bc95d5e532d39287.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\qiake.exe"C:\Users\Admin\qiake.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4076
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5bf68750f54b8a43175c6f38c0b966e84
SHA1743b266bbaa60aec66dc5ee70961744c412626b0
SHA256672423890af509e6b385d700aab9591b1d821d132003ece93bddbed5f0669f6d
SHA51209a2bcc5c43c85ef393d8c2d67d36600c889335b954efa43975b4c22eca283a6bc38d5654e12a9ff9d394b65023693b02d6f34ec8e1eecea4db5b63b4cfbde55
-
Filesize
160KB
MD5bf68750f54b8a43175c6f38c0b966e84
SHA1743b266bbaa60aec66dc5ee70961744c412626b0
SHA256672423890af509e6b385d700aab9591b1d821d132003ece93bddbed5f0669f6d
SHA51209a2bcc5c43c85ef393d8c2d67d36600c889335b954efa43975b4c22eca283a6bc38d5654e12a9ff9d394b65023693b02d6f34ec8e1eecea4db5b63b4cfbde55