Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe
-
Size
96KB
-
MD5
93b5247a731e3f826157522f8ded2eaa
-
SHA1
47b4ddb8d77a19b501e76de5d156aad68f1aef50
-
SHA256
262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497
-
SHA512
8ae364821f1fd2c8fa3e652d71e34ed74ec519905a17e22e31cb83e1d064c7d4921b46a14b994702738d6cafee3ad346d5a112dcd2d0d8008c0df07f6cc7d25e
-
SSDEEP
1536:YxfOsOULMD/2BzVBRpIf8ZGuBs0/PFnI8kIi/5p:qf/OrD/2BZS8ZGuHprep
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wdqauy.exe -
Executes dropped EXE 1 IoCs
pid Process 4760 wdqauy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /x" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /l" 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /k" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /e" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /y" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /t" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /i" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /o" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /a" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /p" wdqauy.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /n" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /z" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /l" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /c" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /g" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /r" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /d" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /v" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /j" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /s" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /b" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /h" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /q" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /w" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /u" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /f" wdqauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdqauy = "C:\\Users\\Admin\\wdqauy.exe /m" wdqauy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 4864 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe 4760 wdqauy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4864 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 4760 wdqauy.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4760 4864 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 83 PID 4864 wrote to memory of 4760 4864 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 83 PID 4864 wrote to memory of 4760 4864 262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe"C:\Users\Admin\AppData\Local\Temp\262e560434e950e978445865aac8bcf52fe3cff1b34164bfacb1ceca28142497.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\wdqauy.exe"C:\Users\Admin\wdqauy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4760
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD525569e0c79f0a2e0927c4d49caf6cecb
SHA17b2bcf282890d3d5d5e2861c84f3dd126e984b44
SHA2566310d01523d144ddf97558c7fda2741f737f820072c78952f8d121393f42c2f6
SHA5125e95e046e9b0ac1933b534e9a17f524d123414802999cbff38448abb98cbb7035dbb003c5b9ed5e1e162b8e14896e1c2bfbdcd4731c42fc82d49384590e44806
-
Filesize
96KB
MD525569e0c79f0a2e0927c4d49caf6cecb
SHA17b2bcf282890d3d5d5e2861c84f3dd126e984b44
SHA2566310d01523d144ddf97558c7fda2741f737f820072c78952f8d121393f42c2f6
SHA5125e95e046e9b0ac1933b534e9a17f524d123414802999cbff38448abb98cbb7035dbb003c5b9ed5e1e162b8e14896e1c2bfbdcd4731c42fc82d49384590e44806