Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 03:23
Static task
static1
Behavioral task
behavioral1
Sample
5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe
-
Size
60KB
-
MD5
00b867cca854b8d60b612a43966c2290
-
SHA1
5a7cf6ad96ada971f8797c2124b906ca649d195c
-
SHA256
5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed
-
SHA512
a6b7463bb974854efcd6b7b7418f0e1a78f0c5a5502d782c38ac12343764cb195dc56b0b2dd1d1c2d1982c63bceec14e2d4c64a4587cd1765c5ab46102104e81
-
SSDEEP
768:2Xxx1BUd8aiRssHH2D2n/z/D0lbdfs3OfKDHGqHg6WB8:2X9raifn2a/Dxg6WB8
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xeayal.exe -
Executes dropped EXE 1 IoCs
pid Process 1788 xeayal.exe -
Loads dropped DLL 2 IoCs
pid Process 1416 5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe 1416 5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xeayal.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\xeayal = "C:\\Users\\Admin\\xeayal.exe" xeayal.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe 1788 xeayal.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1416 5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe 1788 xeayal.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1416 wrote to memory of 1788 1416 5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe 27 PID 1416 wrote to memory of 1788 1416 5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe 27 PID 1416 wrote to memory of 1788 1416 5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe 27 PID 1416 wrote to memory of 1788 1416 5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe 27 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26 PID 1788 wrote to memory of 1416 1788 xeayal.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe"C:\Users\Admin\AppData\Local\Temp\5b04c8ea01f3ddca4852932183f29c9f9045f1e9f691a5ac3c31477be75e44ed.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\xeayal.exe"C:\Users\Admin\xeayal.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD54acf5a2463c86f786c1e54026d2f66c4
SHA1c91aa1b0370a69ad3a16047a76d5436c6a6b8ca6
SHA256753d4270eb8ae278068fa4d28075560978b26e1fed1443adbc51aa385d75e439
SHA512f4eaff62bd0eb2c43ce142bcceed509de6a110a953d2beaa4074d0ce8e83f0f2129e001fa896fad4361ae8eeafb8b5a06746ad48b36ac411b929abf718f9d84b
-
Filesize
60KB
MD54acf5a2463c86f786c1e54026d2f66c4
SHA1c91aa1b0370a69ad3a16047a76d5436c6a6b8ca6
SHA256753d4270eb8ae278068fa4d28075560978b26e1fed1443adbc51aa385d75e439
SHA512f4eaff62bd0eb2c43ce142bcceed509de6a110a953d2beaa4074d0ce8e83f0f2129e001fa896fad4361ae8eeafb8b5a06746ad48b36ac411b929abf718f9d84b
-
Filesize
60KB
MD54acf5a2463c86f786c1e54026d2f66c4
SHA1c91aa1b0370a69ad3a16047a76d5436c6a6b8ca6
SHA256753d4270eb8ae278068fa4d28075560978b26e1fed1443adbc51aa385d75e439
SHA512f4eaff62bd0eb2c43ce142bcceed509de6a110a953d2beaa4074d0ce8e83f0f2129e001fa896fad4361ae8eeafb8b5a06746ad48b36ac411b929abf718f9d84b
-
Filesize
60KB
MD54acf5a2463c86f786c1e54026d2f66c4
SHA1c91aa1b0370a69ad3a16047a76d5436c6a6b8ca6
SHA256753d4270eb8ae278068fa4d28075560978b26e1fed1443adbc51aa385d75e439
SHA512f4eaff62bd0eb2c43ce142bcceed509de6a110a953d2beaa4074d0ce8e83f0f2129e001fa896fad4361ae8eeafb8b5a06746ad48b36ac411b929abf718f9d84b