Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe
-
Size
60KB
-
MD5
911f4923d315d8b0770da00dcd0c4a80
-
SHA1
cc2f023492b30d418ea9de753d4bef23232dca2e
-
SHA256
66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8
-
SHA512
a94e49d0a4361679225949185eb8547fdcdb579b9403fd443b0de2f311f8610325c07dd44c0d98aa9ca12d37415f19b33e05970d85356018772982f691922f49
-
SSDEEP
768:0C3aY/MexaIPQQU6IUcSUBndFIR0NMRs2H06tF1etbw1o+d8sti:0ChMobuactndFa0NM7TtF1Sw1o+d1
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dueik.exe -
Executes dropped EXE 1 IoCs
pid Process 4140 dueik.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /B" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /Y" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /P" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /s" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /U" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /t" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /a" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /g" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /I" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /v" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /Z" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /x" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /i" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /J" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /d" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /b" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /W" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /f" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /K" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /L" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /z" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /q" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /n" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /F" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /u" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /E" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /O" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /m" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /k" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /j" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /h" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /A" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /o" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /G" dueik.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /D" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /e" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /w" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /M" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /C" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /r" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /c" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /T" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /l" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /H" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /V" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /X" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /S" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /N" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /Q" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /R" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /p" dueik.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dueik = "C:\\Users\\Admin\\dueik.exe /y" dueik.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe 4140 dueik.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4348 66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe 4140 dueik.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4348 wrote to memory of 4140 4348 66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe 83 PID 4348 wrote to memory of 4140 4348 66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe 83 PID 4348 wrote to memory of 4140 4348 66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe 83 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82 PID 4140 wrote to memory of 4348 4140 dueik.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe"C:\Users\Admin\AppData\Local\Temp\66533f33348fddacce64c01cb02b1b86c41071c2b76fbd37dee82ea1a5f03fc8.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\dueik.exe"C:\Users\Admin\dueik.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5589dc3caa971bff08101e3cb8a78e312
SHA1712a24652b0fb62dce60fd2bf5d2782e7781e94b
SHA2564041282432ebf32243107f240b793c6c5f82cf1825d5034c1823c9d3b5ca04e3
SHA5124dd98192caf4c9b2e2264891a9f816e39b3e2e708cf64560052a87be69a9bb637411916dfdddc903a981a06192786d0a52e952cf1fd12953d1e91a95b8ee82ae
-
Filesize
60KB
MD5589dc3caa971bff08101e3cb8a78e312
SHA1712a24652b0fb62dce60fd2bf5d2782e7781e94b
SHA2564041282432ebf32243107f240b793c6c5f82cf1825d5034c1823c9d3b5ca04e3
SHA5124dd98192caf4c9b2e2264891a9f816e39b3e2e708cf64560052a87be69a9bb637411916dfdddc903a981a06192786d0a52e952cf1fd12953d1e91a95b8ee82ae