Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe
-
Size
216KB
-
MD5
815ec385f55398e0d411b921a311c1a8
-
SHA1
9a6315aa747375133cb61f18c2e468071fa40ab6
-
SHA256
d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32
-
SHA512
f0fabb15b47a2add622c5a5d448008bbfeccc2073fc10ea7dde6c930af6d0f091a0eaa93e4017d4974eb5e95f13f6daa07788016276900ed37d3e7f62ca48acc
-
SSDEEP
6144:324Ifrt3+TetonBi3QxRy4g09ICSnqf9uSUgkxtpsaPjK/bEoK828fwAoEn+MKb:32zrt3+TetonBi3QxRwfnqf9uSUgkxt7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goifuel.exe -
Executes dropped EXE 1 IoCs
pid Process 1160 goifuel.exe -
Loads dropped DLL 2 IoCs
pid Process 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /l" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /M" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /Q" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /Z" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /v" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /C" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /r" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /f" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /U" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /G" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /O" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /m" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /k" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /I" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /P" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /W" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /L" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /J" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /T" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /c" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /n" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /J" d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /E" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /Y" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /t" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /d" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /w" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /o" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /u" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /j" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /V" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /x" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /q" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /N" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /X" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /A" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /z" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /H" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /s" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /R" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /i" goifuel.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /a" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /g" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /h" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /b" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /S" goifuel.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /e" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /y" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /D" goifuel.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\goifuel = "C:\\Users\\Admin\\goifuel.exe /K" goifuel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe 1160 goifuel.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe 1160 goifuel.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1468 wrote to memory of 1160 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe 27 PID 1468 wrote to memory of 1160 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe 27 PID 1468 wrote to memory of 1160 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe 27 PID 1468 wrote to memory of 1160 1468 d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe"C:\Users\Admin\AppData\Local\Temp\d09a4af73e886805dea6984bb879a347bc5a300a8cbacad90e2425aae2a05e32.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\goifuel.exe"C:\Users\Admin\goifuel.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1160
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD579db3fd9b094694c7174bdb88a308267
SHA1c6115a8f2a543628d72e2911f430fe763a17bbc6
SHA2566acb63f7574052e1a4648f334bbc426cd330997f407ef2f24dbbd37a83da060b
SHA512b22e2922fc9705d4ea4f1981b333b1be2695b823ff1118b81e48d9ad65c641bd123048d1a2911d0be63cba7ac561ac976f578f10cf5ee9ee2ff0788bd63e4239
-
Filesize
216KB
MD579db3fd9b094694c7174bdb88a308267
SHA1c6115a8f2a543628d72e2911f430fe763a17bbc6
SHA2566acb63f7574052e1a4648f334bbc426cd330997f407ef2f24dbbd37a83da060b
SHA512b22e2922fc9705d4ea4f1981b333b1be2695b823ff1118b81e48d9ad65c641bd123048d1a2911d0be63cba7ac561ac976f578f10cf5ee9ee2ff0788bd63e4239
-
Filesize
216KB
MD579db3fd9b094694c7174bdb88a308267
SHA1c6115a8f2a543628d72e2911f430fe763a17bbc6
SHA2566acb63f7574052e1a4648f334bbc426cd330997f407ef2f24dbbd37a83da060b
SHA512b22e2922fc9705d4ea4f1981b333b1be2695b823ff1118b81e48d9ad65c641bd123048d1a2911d0be63cba7ac561ac976f578f10cf5ee9ee2ff0788bd63e4239
-
Filesize
216KB
MD579db3fd9b094694c7174bdb88a308267
SHA1c6115a8f2a543628d72e2911f430fe763a17bbc6
SHA2566acb63f7574052e1a4648f334bbc426cd330997f407ef2f24dbbd37a83da060b
SHA512b22e2922fc9705d4ea4f1981b333b1be2695b823ff1118b81e48d9ad65c641bd123048d1a2911d0be63cba7ac561ac976f578f10cf5ee9ee2ff0788bd63e4239