Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26/11/2022, 22:59
Static task
static1
Behavioral task
behavioral1
Sample
3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe
-
Size
100KB
-
MD5
7d0c314d2a29339166d1b2d51a23e09d
-
SHA1
d1a00709261c43933c19111828a355f4df9d0a12
-
SHA256
3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3
-
SHA512
cb6e71a9042faab20dbaf03aa649721516456343b75a5dd8848821ad24ac4017f396788d3d95bcb158cb8d25c52503e83b748c526b3f35f9871861a712816f8b
-
SSDEEP
1536:zD17jQlzlHP1UtGgH0tCSoe11z3yqM4/0bucdU/mNYjiZcHvIyi68q7+FSlDKBww:vqlzFP1U1ju0QK
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" doiuxof.exe -
Executes dropped EXE 1 IoCs
pid Process 1480 doiuxof.exe -
Loads dropped DLL 2 IoCs
pid Process 832 3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe 832 3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ doiuxof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\doiuxof = "C:\\Users\\Admin\\doiuxof.exe" doiuxof.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe 1480 doiuxof.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 832 3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe 1480 doiuxof.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 832 wrote to memory of 1480 832 3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe 28 PID 832 wrote to memory of 1480 832 3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe 28 PID 832 wrote to memory of 1480 832 3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe 28 PID 832 wrote to memory of 1480 832 3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe 28 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21 PID 1480 wrote to memory of 832 1480 doiuxof.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe"C:\Users\Admin\AppData\Local\Temp\3039034a150187f22416e28c2f8f1410c01bec982f3535d7f89863cb14cbf5c3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\doiuxof.exe"C:\Users\Admin\doiuxof.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD54890e4cdf5af9d39c7f0b7ef1e5c384d
SHA1e783754ed64116de67f1e1906fcdcc579e723fee
SHA256168a9180f325cc249dd980cd7ab6219b9a2018088813d54afc78cba307f87dc5
SHA5121a4055c71b25f72bcd71e56b9f1651e676c59e52bbc3a00ed10828de76d38de63a9e687abaca66bfacb59f2690e6f269f1a04ee6902b180ec929c748782aa824
-
Filesize
100KB
MD54890e4cdf5af9d39c7f0b7ef1e5c384d
SHA1e783754ed64116de67f1e1906fcdcc579e723fee
SHA256168a9180f325cc249dd980cd7ab6219b9a2018088813d54afc78cba307f87dc5
SHA5121a4055c71b25f72bcd71e56b9f1651e676c59e52bbc3a00ed10828de76d38de63a9e687abaca66bfacb59f2690e6f269f1a04ee6902b180ec929c748782aa824
-
Filesize
100KB
MD54890e4cdf5af9d39c7f0b7ef1e5c384d
SHA1e783754ed64116de67f1e1906fcdcc579e723fee
SHA256168a9180f325cc249dd980cd7ab6219b9a2018088813d54afc78cba307f87dc5
SHA5121a4055c71b25f72bcd71e56b9f1651e676c59e52bbc3a00ed10828de76d38de63a9e687abaca66bfacb59f2690e6f269f1a04ee6902b180ec929c748782aa824
-
Filesize
100KB
MD54890e4cdf5af9d39c7f0b7ef1e5c384d
SHA1e783754ed64116de67f1e1906fcdcc579e723fee
SHA256168a9180f325cc249dd980cd7ab6219b9a2018088813d54afc78cba307f87dc5
SHA5121a4055c71b25f72bcd71e56b9f1651e676c59e52bbc3a00ed10828de76d38de63a9e687abaca66bfacb59f2690e6f269f1a04ee6902b180ec929c748782aa824