Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
227s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe
-
Size
168KB
-
MD5
137cfc6b3ad4ae7607a655c964a3e2c6
-
SHA1
319d2bfba00441b0894758ba060cffce9ebeacb6
-
SHA256
13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
-
SHA512
858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
SSDEEP
1536:nxerLPMj4VxhkKlX9Cms33YoKw8Pm6/qr8qyhhLDhUeKKfRpO0t9gVjx1guqgzM0:xOMKlEmsHKHPmLq7eeJsk6Rqwq4d
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" daohie.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe -
Executes dropped EXE 2 IoCs
pid Process 1280 daohie.exe 1368 daohie.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /j" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /v" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /o" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /x" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /h" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /e" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /y" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /r" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /u" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /k" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /w" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /d" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /a" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /q" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /b" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /f" 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /n" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /g" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /i" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /s" daohie.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /z" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /f" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /t" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /c" daohie.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\ daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /l" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /p" daohie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\daohie = "C:\\Users\\Admin\\daohie.exe /m" daohie.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 daohie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum daohie.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\c\autorun.inf daohie.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5068 set thread context of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 1280 set thread context of 1368 1280 daohie.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3604 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 3604 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe 1368 daohie.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 3604 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 1280 daohie.exe 1368 daohie.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 5068 wrote to memory of 3604 5068 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 82 PID 3604 wrote to memory of 1280 3604 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 83 PID 3604 wrote to memory of 1280 3604 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 83 PID 3604 wrote to memory of 1280 3604 13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe 83 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84 PID 1280 wrote to memory of 1368 1280 daohie.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe"C:\Users\Admin\AppData\Local\Temp\13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\13a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8.exe722⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\daohie.exe"C:\Users\Admin\daohie.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\daohie.exe724⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1368
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce
-
Filesize
168KB
MD5137cfc6b3ad4ae7607a655c964a3e2c6
SHA1319d2bfba00441b0894758ba060cffce9ebeacb6
SHA25613a6f0c7056952718b52bd697abefdd84a26791f2b7fd80f5a91f67996f853b8
SHA512858675ae435d160d5d40789e2e98c9ddb47c977131d2e858599626238b75f21a79fff10390c954f8e725a90cb0f7f34e5f0d539c1d1d8b0b1261f23a0b6ab4ce