Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe
-
Size
240KB
-
MD5
0c9a41f12c4e7cfd4bf91b1a98c27d40
-
SHA1
c7c168eaa3a357d5fcae4d2f19096c9ec2ad8acc
-
SHA256
2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034
-
SHA512
98521f2adefcaf77d8e1c8dc2a3f9dd04f9041c28bb22b0239c85bb4f16d56c2eadc382664a647ead2dcd88fc5a04fa2b7a4eafc3d2fa5c3244b0e2f1c202bc4
-
SSDEEP
3072:LkBGaT8j6VlpvBd90i/SmWKLi7CjFSivnfu3fbMdozt5cz+Yj:L20UGKGkFRKfeoztO3
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" soiqa.exe -
Executes dropped EXE 1 IoCs
pid Process 1788 soiqa.exe -
Loads dropped DLL 2 IoCs
pid Process 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /v" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /t" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /f" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /e" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /k" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /p" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /o" soiqa.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /i" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /l" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /g" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /j" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /x" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /a" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /s" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /m" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /b" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /c" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /n" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /d" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /u" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /w" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /y" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /q" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /h" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /m" 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /z" soiqa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\soiqa = "C:\\Users\\Admin\\soiqa.exe /r" soiqa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe 1788 soiqa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 1788 soiqa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1788 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 27 PID 1724 wrote to memory of 1788 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 27 PID 1724 wrote to memory of 1788 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 27 PID 1724 wrote to memory of 1788 1724 2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe"C:\Users\Admin\AppData\Local\Temp\2f16c3e2c341e398e99552a076d6ebceeb8dbfdcfb2b5386b2a48984e62b5034.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\soiqa.exe"C:\Users\Admin\soiqa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1788
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD58ef12891f310728bbd58d6699436cccb
SHA1bb0110e0cbd1d0c29f51f4db6e04987620614dfc
SHA256922857d9bc55391675d4bf54a59615638316f0e0d70da0fb1449d0c69653ea55
SHA51237dfb787a808eb6f31b7af3a1a65a6e7a71c257abcadadca69e3c8c936acc7fdd4a3499fdb64498d172fccae75d8c3589283560515b7446272f48cf76273ac5c
-
Filesize
240KB
MD58ef12891f310728bbd58d6699436cccb
SHA1bb0110e0cbd1d0c29f51f4db6e04987620614dfc
SHA256922857d9bc55391675d4bf54a59615638316f0e0d70da0fb1449d0c69653ea55
SHA51237dfb787a808eb6f31b7af3a1a65a6e7a71c257abcadadca69e3c8c936acc7fdd4a3499fdb64498d172fccae75d8c3589283560515b7446272f48cf76273ac5c
-
Filesize
240KB
MD58ef12891f310728bbd58d6699436cccb
SHA1bb0110e0cbd1d0c29f51f4db6e04987620614dfc
SHA256922857d9bc55391675d4bf54a59615638316f0e0d70da0fb1449d0c69653ea55
SHA51237dfb787a808eb6f31b7af3a1a65a6e7a71c257abcadadca69e3c8c936acc7fdd4a3499fdb64498d172fccae75d8c3589283560515b7446272f48cf76273ac5c
-
Filesize
240KB
MD58ef12891f310728bbd58d6699436cccb
SHA1bb0110e0cbd1d0c29f51f4db6e04987620614dfc
SHA256922857d9bc55391675d4bf54a59615638316f0e0d70da0fb1449d0c69653ea55
SHA51237dfb787a808eb6f31b7af3a1a65a6e7a71c257abcadadca69e3c8c936acc7fdd4a3499fdb64498d172fccae75d8c3589283560515b7446272f48cf76273ac5c