Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe
-
Size
53KB
-
MD5
0b1a2a1e9e8d8102d7f80418096f6091
-
SHA1
3af62a815e1b62e5c9d9d11a4d8ac24e85fac26c
-
SHA256
a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e
-
SHA512
a885928399f995494120b00f8bddf5367055ba7b204322d7175db97c0ce3ea07a16e6b9fbea53fcaf6bbc1bf14ce16367d12794fb67882e42a3a4bc58e4e0e40
-
SSDEEP
1536:HNe2g8r8QVO+fr87Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:9O+gJJjmLM3zRJWZsXy4J9
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" muiom.exe -
Executes dropped EXE 1 IoCs
pid Process 2640 muiom.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ muiom.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muiom = "C:\\Users\\Admin\\muiom.exe" muiom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe 2640 muiom.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3060 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 2640 muiom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2640 3060 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 79 PID 3060 wrote to memory of 2640 3060 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 79 PID 3060 wrote to memory of 2640 3060 a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe 79 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78 PID 2640 wrote to memory of 3060 2640 muiom.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe"C:\Users\Admin\AppData\Local\Temp\a593fed01989840a6068b9529a02f9d2df31cfb7d29e2b678b5235cdfd4a6f0e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\muiom.exe"C:\Users\Admin\muiom.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD55485ae38c11ff0ed11949f206af0c12a
SHA15274ef69ca9f8890f252b129e64de51b20f9fa63
SHA2562a7004fb51ab0ed11f17b5b297ad41e10f15dcddf90709d668c507b94b6d14ec
SHA51260ff335825ffc11cb0dd3656475155cfe4f3e6cfc7e38b43e14f9c16398765ed8cd67d8dce2b53a5145a2598caf5e879bfa01876578b2d8696345c06d16f8911
-
Filesize
53KB
MD55485ae38c11ff0ed11949f206af0c12a
SHA15274ef69ca9f8890f252b129e64de51b20f9fa63
SHA2562a7004fb51ab0ed11f17b5b297ad41e10f15dcddf90709d668c507b94b6d14ec
SHA51260ff335825ffc11cb0dd3656475155cfe4f3e6cfc7e38b43e14f9c16398765ed8cd67d8dce2b53a5145a2598caf5e879bfa01876578b2d8696345c06d16f8911