Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 11:32
Static task
static1
Behavioral task
behavioral1
Sample
c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe
-
Size
156KB
-
MD5
0f1e088fb6abb4d2ad366285e00708b2
-
SHA1
206c0eecfe4c3c3f20bc7e544b2f59f0ded54ce3
-
SHA256
c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42
-
SHA512
e0001fe3ade758b4840619cfb0d4919bf5a146a5ca05912895d9459720689a88e1b3aba1f8063ebc76e5cb7ccd1d905ec63c351b9668104165c930ae30ae9b2e
-
SSDEEP
3072:DpJewsFgyqTRlU3NhCBvu9pjZEwDxdr8JrFO:9JvRl+NhwWrjuwDQ6
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" muimoo.exe -
Executes dropped EXE 1 IoCs
pid Process 892 muimoo.exe -
Loads dropped DLL 2 IoCs
pid Process 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /t" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /w" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /U" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /G" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /K" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /D" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /p" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /I" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /x" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /z" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /j" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /l" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /W" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /O" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /q" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /E" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /v" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /F" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /c" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /s" muimoo.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /C" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /f" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /Y" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /e" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /d" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /O" c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /o" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /V" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /k" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /h" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /b" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /J" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /n" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /S" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /y" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /B" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /g" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /u" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /P" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /r" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /Q" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /X" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /N" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /a" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /H" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /i" muimoo.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /R" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /Z" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /m" muimoo.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\muimoo = "C:\\Users\\Admin\\muimoo.exe /L" muimoo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe 892 muimoo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe 892 muimoo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 892 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe 26 PID 1976 wrote to memory of 892 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe 26 PID 1976 wrote to memory of 892 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe 26 PID 1976 wrote to memory of 892 1976 c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe"C:\Users\Admin\AppData\Local\Temp\c8961ba501ff55772fb15696eac4db5e3c8c0393000a6a5e76215729bd45ef42.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\muimoo.exe"C:\Users\Admin\muimoo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD50b6e800475e1d8a74364ffa99739ace3
SHA14bbfcc6e5f6d7d01c6ab45f5669144b23d171db5
SHA2561b0b0406eb05d8de1aab3a34977a3641e79b79b01aed0cda6bf1992e3e513a29
SHA51299355cb4e6861e4aac62379007e21847be919362d7e52d59d2065c52625ab17e26b41897d5822471197ad2c6ed6b94abcf4542f655cd65467b1cd18518d6ef01
-
Filesize
156KB
MD50b6e800475e1d8a74364ffa99739ace3
SHA14bbfcc6e5f6d7d01c6ab45f5669144b23d171db5
SHA2561b0b0406eb05d8de1aab3a34977a3641e79b79b01aed0cda6bf1992e3e513a29
SHA51299355cb4e6861e4aac62379007e21847be919362d7e52d59d2065c52625ab17e26b41897d5822471197ad2c6ed6b94abcf4542f655cd65467b1cd18518d6ef01
-
Filesize
156KB
MD50b6e800475e1d8a74364ffa99739ace3
SHA14bbfcc6e5f6d7d01c6ab45f5669144b23d171db5
SHA2561b0b0406eb05d8de1aab3a34977a3641e79b79b01aed0cda6bf1992e3e513a29
SHA51299355cb4e6861e4aac62379007e21847be919362d7e52d59d2065c52625ab17e26b41897d5822471197ad2c6ed6b94abcf4542f655cd65467b1cd18518d6ef01
-
Filesize
156KB
MD50b6e800475e1d8a74364ffa99739ace3
SHA14bbfcc6e5f6d7d01c6ab45f5669144b23d171db5
SHA2561b0b0406eb05d8de1aab3a34977a3641e79b79b01aed0cda6bf1992e3e513a29
SHA51299355cb4e6861e4aac62379007e21847be919362d7e52d59d2065c52625ab17e26b41897d5822471197ad2c6ed6b94abcf4542f655cd65467b1cd18518d6ef01