Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
205s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 00:49
Static task
static1
Behavioral task
behavioral1
Sample
ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe
-
Size
111KB
-
MD5
00908632ea7dd0bbee337cfbcd770c50
-
SHA1
6ade76f7eaa1ce8e1d43fd5784d1ee2c4600e8ad
-
SHA256
ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b
-
SHA512
31fe8b0ccf44a63b6491e134fbfa4c7183b3dc8ddeae808e0523aab9a38194df113156e41f8b9d65b9dc49deb8ffcd0357d95583322f0f4eefd136e2c60d4604
-
SSDEEP
768:sduwfCcDlgcjlNqe9PP34DGltCJWx+7AppL4zG4dslM8lP+wgG0SXdkUr9AeXU7C:sdFrflR93lN+aLHM8WSXjyi
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" diagooh.exe -
Executes dropped EXE 1 IoCs
pid Process 516 diagooh.exe -
Loads dropped DLL 2 IoCs
pid Process 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ diagooh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\diagooh = "C:\\Users\\Admin\\diagooh.exe" diagooh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 576 1488 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe 516 diagooh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 516 diagooh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 516 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 28 PID 1488 wrote to memory of 516 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 28 PID 1488 wrote to memory of 516 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 28 PID 1488 wrote to memory of 516 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 28 PID 1488 wrote to memory of 576 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 29 PID 1488 wrote to memory of 576 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 29 PID 1488 wrote to memory of 576 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 29 PID 1488 wrote to memory of 576 1488 ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 1488 516 diagooh.exe 27 PID 516 wrote to memory of 576 516 diagooh.exe 29 PID 516 wrote to memory of 576 516 diagooh.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe"C:\Users\Admin\AppData\Local\Temp\ad949729f2ea8716139567039aabd284db75b0ee839e325022fbfdb556c5fe4b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\diagooh.exe"C:\Users\Admin\diagooh.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 8162⤵
- Program crash
PID:576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD57c25168642d74d013688b85961d90199
SHA16c63146406894933d6242691095dc46d7eca1bab
SHA25673b5da6dc0403306b79b8b6ed5881a5127854ecceb30a9120e884c0d1b12795a
SHA512834da505de7363f3dad328267dc34c04221a9c5ca10d2b5784707e4e024984d276775fb2b2b36682993ab46f04d8b72435622b7d74002bede0dd823d171dd54b
-
Filesize
111KB
MD57c25168642d74d013688b85961d90199
SHA16c63146406894933d6242691095dc46d7eca1bab
SHA25673b5da6dc0403306b79b8b6ed5881a5127854ecceb30a9120e884c0d1b12795a
SHA512834da505de7363f3dad328267dc34c04221a9c5ca10d2b5784707e4e024984d276775fb2b2b36682993ab46f04d8b72435622b7d74002bede0dd823d171dd54b
-
Filesize
111KB
MD57c25168642d74d013688b85961d90199
SHA16c63146406894933d6242691095dc46d7eca1bab
SHA25673b5da6dc0403306b79b8b6ed5881a5127854ecceb30a9120e884c0d1b12795a
SHA512834da505de7363f3dad328267dc34c04221a9c5ca10d2b5784707e4e024984d276775fb2b2b36682993ab46f04d8b72435622b7d74002bede0dd823d171dd54b
-
Filesize
111KB
MD57c25168642d74d013688b85961d90199
SHA16c63146406894933d6242691095dc46d7eca1bab
SHA25673b5da6dc0403306b79b8b6ed5881a5127854ecceb30a9120e884c0d1b12795a
SHA512834da505de7363f3dad328267dc34c04221a9c5ca10d2b5784707e4e024984d276775fb2b2b36682993ab46f04d8b72435622b7d74002bede0dd823d171dd54b