Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe
-
Size
168KB
-
MD5
137cfc6b3ad4ae7607a655c964a3e2c6
-
SHA1
319d2bfba00441b0894758ba060cffce9ebeacb6
-
SHA256
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
-
SHA512
858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
SSDEEP
1536:nxerLPMj4VxhkKlX9Cms33YoKw8Pm6/qr8qyhhLDhUeKKfRpO0t9gVjx1guqgzM0:xOMKlEmsHKHPmLq7eeJsk6Rqwq4d
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jieabit.exe -
Executes dropped EXE 2 IoCs
pid Process 1928 jieabit.exe 1640 jieabit.exe -
Loads dropped DLL 2 IoCs
pid Process 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /b" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /y" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /o" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /c" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /p" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /n" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /w" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /r" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /e" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /a" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /t" jieabit.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /h" 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /g" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /s" jieabit.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /z" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /x" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /h" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /u" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /l" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /f" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /v" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /i" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /q" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /d" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /k" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /j" jieabit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jieabit = "C:\\Users\\Admin\\jieabit.exe /m" jieabit.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum jieabit.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 jieabit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\c\autorun.inf jieabit.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1824 set thread context of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1928 set thread context of 1640 1928 jieabit.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe 1640 jieabit.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 1928 jieabit.exe 1640 jieabit.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1824 wrote to memory of 1880 1824 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 27 PID 1880 wrote to memory of 1928 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 28 PID 1880 wrote to memory of 1928 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 28 PID 1880 wrote to memory of 1928 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 28 PID 1880 wrote to memory of 1928 1880 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 28 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29 PID 1928 wrote to memory of 1640 1928 jieabit.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe"C:\Users\Admin\AppData\Local\Temp\13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe722⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\jieabit.exe"C:\Users\Admin\jieabit.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\jieabit.exe724⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce