Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe
-
Size
152KB
-
MD5
7e12640bc065bd9bc82d11bf7d6522ff
-
SHA1
08c1721fb0d2b8851e89e25f0ea39b2237ef1e26
-
SHA256
6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8
-
SHA512
9facb67a1fa3af772055dc13de09898cd4a738ea46441a0c2c8282ad93ed8e2091301298fb9d0902eb84d0633bdc247aa0556031050c5f34704963bd3051dc00
-
SSDEEP
3072:BhUFgQTQtKrueiygR4O6avJamofZ4oQZiEcJTh:2gEQtKSMgR56avUm2WSj
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gouhep.exe -
Executes dropped EXE 1 IoCs
pid Process 216 gouhep.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /k" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /H" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /R" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /t" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /F" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /V" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /U" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /q" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /O" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /K" 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /I" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /l" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /r" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /P" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /L" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /G" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /y" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /j" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /S" gouhep.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /u" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /w" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /g" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /m" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /C" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /v" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /Y" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /A" gouhep.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /Z" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /d" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /h" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /B" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /J" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /N" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /T" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /D" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /p" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /i" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /z" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /K" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /n" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /W" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /E" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /a" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /x" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /M" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /s" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /o" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /Q" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /f" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /e" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /X" gouhep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gouhep = "C:\\Users\\Admin\\gouhep.exe /c" gouhep.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4388 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 4388 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe 216 gouhep.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4388 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 216 gouhep.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4388 wrote to memory of 216 4388 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 81 PID 4388 wrote to memory of 216 4388 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 81 PID 4388 wrote to memory of 216 4388 6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe"C:\Users\Admin\AppData\Local\Temp\6782cbcaaf33f2778eaae119924107c2a208652a065530d3d9ad73182bf7abf8.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\gouhep.exe"C:\Users\Admin\gouhep.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:216
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD585ae8aad5755382388fdf4bf8e78a08b
SHA1a09a8c0809d52ddb8e84e9341e40f5efd39cf57d
SHA25688ef5153997f27e66ab497e0abc0554d0a68e701ef3c30ceb3639884dc793af5
SHA512f1f6a95542c430dfd13a96df9dad95c2ed816bc937ce6d99e44f6d4bd940aef8dc063790d206d75f3965b1537144a80dd2390b7d97acdef2618a23d8142ac7de
-
Filesize
152KB
MD585ae8aad5755382388fdf4bf8e78a08b
SHA1a09a8c0809d52ddb8e84e9341e40f5efd39cf57d
SHA25688ef5153997f27e66ab497e0abc0554d0a68e701ef3c30ceb3639884dc793af5
SHA512f1f6a95542c430dfd13a96df9dad95c2ed816bc937ce6d99e44f6d4bd940aef8dc063790d206d75f3965b1537144a80dd2390b7d97acdef2618a23d8142ac7de