Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe
-
Size
124KB
-
MD5
f9cf85c1a37d6e24ab38e63c0c398272
-
SHA1
4ccbffeca674ab347780daa81924071d13683f9d
-
SHA256
61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0
-
SHA512
75a07021444247d2a794fe75eb82e320fa348d56992489eb223a4b4fce603812f7715327b2bc361d9f4ecb5f3456ff50d0f2e8bda7f31248f3c2e49c13401ffa
-
SSDEEP
1536:6TEShwR+uBxeDtMYHa27J14ltxporZ45iMNeG0h/y:kEShwR+keV6gJ1uCt45eq
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jxqin.exe -
Executes dropped EXE 1 IoCs
pid Process 4696 jxqin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /N" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /n" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /x" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /o" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /M" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /C" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /k" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /m" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /X" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /s" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /p" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /K" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /Q" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /e" jxqin.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /c" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /b" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /J" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /r" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /d" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /Y" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /I" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /T" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /S" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /y" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /z" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /g" jxqin.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /Z" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /G" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /A" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /B" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /L" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /V" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /U" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /l" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /v" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /h" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /q" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /D" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /i" 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /w" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /W" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /P" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /t" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /O" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /R" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /i" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /j" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /u" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /f" jxqin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jxqin = "C:\\Users\\Admin\\jxqin.exe /F" jxqin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4048 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe 4048 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe 4696 jxqin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4048 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe 4696 jxqin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4048 wrote to memory of 4696 4048 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe 84 PID 4048 wrote to memory of 4696 4048 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe 84 PID 4048 wrote to memory of 4696 4048 61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe"C:\Users\Admin\AppData\Local\Temp\61c2d956abd3ae0e7da01f83c91b64db39ab1de3b92dcf10b3a22305591f61f0.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\jxqin.exe"C:\Users\Admin\jxqin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4696
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5cc00ebf94b29da9354e1776b60e36823
SHA189202ac6b08ec93fecfefca76ad51476c7206e42
SHA256f8cbfd29bd824b19e18fab87f3149c2ca18fe1b40572b93777fee48433f22a79
SHA512a3a73199178653b22f3a82d565f09179ff5aa539404fc41fbcc259749bba564277264ae46677f295ad887e1911d65c20b90c76bcda22fbbd605b804dc6235b66
-
Filesize
124KB
MD5cc00ebf94b29da9354e1776b60e36823
SHA189202ac6b08ec93fecfefca76ad51476c7206e42
SHA256f8cbfd29bd824b19e18fab87f3149c2ca18fe1b40572b93777fee48433f22a79
SHA512a3a73199178653b22f3a82d565f09179ff5aa539404fc41fbcc259749bba564277264ae46677f295ad887e1911d65c20b90c76bcda22fbbd605b804dc6235b66