Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
297s -
max time network
350s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29/11/2022, 04:50
General
-
Target
984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781.exe
-
Size
63KB
-
MD5
bd1ebf18f7f0ef1c309617f672ab8335
-
SHA1
739c9c16b2bb153ae5138a7318a58ad8ea261be1
-
SHA256
984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
-
SHA512
5d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
SSDEEP
1536:OrZtaewPBaF79KuUbYLAlBVOjEKHGkOqYtiHLl7ss:ODahPBarKpbqAjVOAiGklFLlss
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 5 IoCs
-
Modifies system executable filetype association 2 TTPs 4 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
Executes dropped EXE 11 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 11 IoCs
-
Adds Run key to start application 2 TTPs 12 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 26 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 44 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781.exe"C:\Users\Admin\AppData\Local\Temp\984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllChache\Empty.jpgC:\Windows\system32\dllChache\Empty.jpg ReStart2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllChache\Empty.jpgC:\Windows\system32\dllChache\Empty.jpg ReStart3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\dllChache\Blank.docC:\Windows\system32\dllChache\Blank.doc ReStart3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllChache\Blank.docC:\Windows\system32\dllChache\Blank.doc ReStart4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\dllChache\Zero.txtC:\Windows\system32\dllChache\Zero.txt ReStart4⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\dllChache\Blank.docC:\Windows\system32\dllChache\Blank.doc ReStart2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllChache\Blank.docC:\Windows\system32\dllChache\Blank.doc ReStart3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\dllChache\Zero.txtC:\Windows\system32\dllChache\Zero.txt ReStart3⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\dllChache\Zero.txtC:\Windows\system32\dllChache\Zero.txt ReStart2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\dllChache\Hole.zipC:\Windows\system32\dllChache\Hole.zip ReStart2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\dllChache\Unoccupied.regC:\Windows\system32\dllChache\Unoccupied.reg ReStart2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c27812⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
63KB
MD5bd1ebf18f7f0ef1c309617f672ab8335
SHA1739c9c16b2bb153ae5138a7318a58ad8ea261be1
SHA256984ae1615eeca88944358dad0c893f955298fe901a93417d422f1f97067c2781
SHA5125d27761802e455490f03d6d052feb69cdce1d5c80e25af6b987121fb5c0002b269f1ad1b38b7b7b40a31ff978457abda68129bacf32ede7fad6abb56d4bfa0c6
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
164KB
