Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe
-
Size
53KB
-
MD5
0b1a2a1e9e8d8102d7f80418096f6091
-
SHA1
3af62a815e1b62e5c9d9d11a4d8ac24e85fac26c
-
SHA256
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e
-
SHA512
a885928399f995494120b00f8bddf5367055ba7b204322d7175db97c0ce3ea07a16e6b9fbea53fcaf6bbc1bf14ce16367d12794fb67882e42a3a4bc58e4e0e40
-
SSDEEP
1536:HNe2g8r8QVO+fr87Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:9O+gJJjmLM3zRJWZsXy4J9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ysgut.exe -
Executes dropped EXE 1 IoCs
pid Process 2028 ysgut.exe -
Loads dropped DLL 2 IoCs
pid Process 1652 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 1652 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ysgut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ysgut = "C:\\Users\\Admin\\ysgut.exe" ysgut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe 2028 ysgut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1652 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 2028 ysgut.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2028 1652 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 28 PID 1652 wrote to memory of 2028 1652 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 28 PID 1652 wrote to memory of 2028 1652 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 28 PID 1652 wrote to memory of 2028 1652 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 28 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27 PID 2028 wrote to memory of 1652 2028 ysgut.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe"C:\Users\Admin\AppData\Local\Temp\a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\ysgut.exe"C:\Users\Admin\ysgut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD53203b5b74e391706482b2bd273a50517
SHA1a20667371b9274b5f35074d964c26d6ba332a2e2
SHA25630955144a4cf809b73dfecb266e221b9bc00a664f549436f57fdfff9ff949574
SHA512aa5ca36178c2571493189dd96ae13804e7f9f8d36caa39c3321fc791e35da9654b4e73186ba59bd1e5c45ad6145ed2d1183e27ce6eac1122279c6c04e24e3687
-
Filesize
53KB
MD53203b5b74e391706482b2bd273a50517
SHA1a20667371b9274b5f35074d964c26d6ba332a2e2
SHA25630955144a4cf809b73dfecb266e221b9bc00a664f549436f57fdfff9ff949574
SHA512aa5ca36178c2571493189dd96ae13804e7f9f8d36caa39c3321fc791e35da9654b4e73186ba59bd1e5c45ad6145ed2d1183e27ce6eac1122279c6c04e24e3687
-
Filesize
53KB
MD53203b5b74e391706482b2bd273a50517
SHA1a20667371b9274b5f35074d964c26d6ba332a2e2
SHA25630955144a4cf809b73dfecb266e221b9bc00a664f549436f57fdfff9ff949574
SHA512aa5ca36178c2571493189dd96ae13804e7f9f8d36caa39c3321fc791e35da9654b4e73186ba59bd1e5c45ad6145ed2d1183e27ce6eac1122279c6c04e24e3687
-
Filesize
53KB
MD53203b5b74e391706482b2bd273a50517
SHA1a20667371b9274b5f35074d964c26d6ba332a2e2
SHA25630955144a4cf809b73dfecb266e221b9bc00a664f549436f57fdfff9ff949574
SHA512aa5ca36178c2571493189dd96ae13804e7f9f8d36caa39c3321fc791e35da9654b4e73186ba59bd1e5c45ad6145ed2d1183e27ce6eac1122279c6c04e24e3687