Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe
Resource
win10v2004-20220812-en
General
-
Target
23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe
-
Size
6.4MB
-
MD5
0bba108e8634e1ba0c9c89e081581fe9
-
SHA1
b656092c5cae1e2621316d357cdf132c386bb11d
-
SHA256
23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b
-
SHA512
aaf40d6154d0a7d134530f51cce0e354e81e36a9726486b88c02b2bc098daf03f95fe5ad9e65cf64faa288e0e05686285c3b1bab0146d2e9aab5908b6af348d8
-
SSDEEP
196608:fqHgPs2e0666VdVF/wAj7EsfK4iOevZxbubx3BZ:fqAhe0OVjVLj7EsUnHKx3j
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2132 ll8kll8k.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ALXO\ImagePath = "C:\\Program Files\\Nfyop\\Niuvy.exe" 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Nfyop\cetovse\pat.xml 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File created C:\Program Files\Nfyop\cetovse\vehese.dll 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File created C:\Program Files\Nfyop\devoof.exe 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\Niuvy.exe 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\Wece.exe 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\caivs.exe 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\jy.ini 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\Reuj\Xihy.dll 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File created C:\Program Files\Nfyop\jy.ini 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File created C:\Program Files\Common Files\System\Ole DB\MSPat.xml 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\MSPat.xml 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File created C:\Program Files\Nfyop\caivs.exe 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\cetovse\pat.xml 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\cetovse\vehese.dll 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe File opened for modification C:\Program Files\Nfyop\devoof.exe 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2132 ll8kll8k.exe 2132 ll8kll8k.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2132 3212 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe 81 PID 3212 wrote to memory of 2132 3212 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe 81 PID 3212 wrote to memory of 2132 3212 23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe"C:\Users\Admin\AppData\Local\Temp\23462359b5dd06b04ba7177fab005965dc7ce0df9d12e5650e4754de758aed4b.exe"1⤵
- Sets service image path in registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\g8904E\ll8kll8k.exeC:\Users\Admin\AppData\Local\Temp\g8904E\ll8kll8k.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
MD5ee6a584a57c2cab4ecb9cbb170336190
SHA12908a67d4239f77efe96dc9ae97fa23fe8c6a95d
SHA256dcd4ddf3d20e959ed2ae3328e818c14fef63605b8178905d15269cfe8a53cf04
SHA512f198183e0ff400a6a87318afe30ac0132097e38684cd345eb7f6b407ea121270169c0bfd94b0f35710d70e3b459c78e2557e7011d788d0b0a76774ca8ee50c00
-
Filesize
4.5MB
MD5ee6a584a57c2cab4ecb9cbb170336190
SHA12908a67d4239f77efe96dc9ae97fa23fe8c6a95d
SHA256dcd4ddf3d20e959ed2ae3328e818c14fef63605b8178905d15269cfe8a53cf04
SHA512f198183e0ff400a6a87318afe30ac0132097e38684cd345eb7f6b407ea121270169c0bfd94b0f35710d70e3b459c78e2557e7011d788d0b0a76774ca8ee50c00