Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
Resource
win10v2004-20221111-en
General
-
Target
e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
-
Size
54KB
-
MD5
2a3fb18c680d1db507969f93ad76b726
-
SHA1
9a60bb7131f93e94274ffbfb722f4b53b906d6b1
-
SHA256
e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803
-
SHA512
d59c90e640e45e326096581b935a018f2f007607ac1c27471c723c39cbf7c314e11442c7cba34bf3635dcb6c8a8d8d6a76e5b5a68c5670e5104b1960f38bf344
-
SSDEEP
768:6rpGUKbGPJfS/A+0jmlZ8veI+2qYg7ZffFLCNnbcuyD7U7R:6Hq/ADjmlZ8GITMdL2nouy87R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1692 coiome.exe -
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
pid Process 560 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run mshta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\safe360 = "C:\\Program Files\\Common Files\\sfbsbvx\\coiome.exe" mshta.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\sfbsbvx e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe File created C:\Program Files (x86)\DGT.hta e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe File created C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe File opened for modification C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe File opened for modification C:\Program Files (x86)\Common Files\sfbsbvx coiome.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2008 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1072 taskkill.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\default_page_url = "http://www.52cailing.com" mshta.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.52cailing.com" mshta.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.52cailing.com" mshta.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe Token: SeDebugPrivilege 1072 taskkill.exe Token: SeDebugPrivilege 1692 coiome.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 868 wrote to memory of 1656 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 28 PID 868 wrote to memory of 1656 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 28 PID 868 wrote to memory of 1656 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 28 PID 868 wrote to memory of 1656 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 28 PID 868 wrote to memory of 1420 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 30 PID 868 wrote to memory of 1420 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 30 PID 868 wrote to memory of 1420 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 30 PID 868 wrote to memory of 1420 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 30 PID 1420 wrote to memory of 1072 1420 cmd.exe 32 PID 1420 wrote to memory of 1072 1420 cmd.exe 32 PID 1420 wrote to memory of 1072 1420 cmd.exe 32 PID 1420 wrote to memory of 1072 1420 cmd.exe 32 PID 868 wrote to memory of 1692 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 34 PID 868 wrote to memory of 1692 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 34 PID 868 wrote to memory of 1692 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 34 PID 868 wrote to memory of 1692 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 34 PID 868 wrote to memory of 560 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 35 PID 868 wrote to memory of 560 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 35 PID 868 wrote to memory of 560 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 35 PID 868 wrote to memory of 560 868 e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe 35 PID 1692 wrote to memory of 860 1692 coiome.exe 38 PID 1692 wrote to memory of 860 1692 coiome.exe 38 PID 1692 wrote to memory of 860 1692 coiome.exe 38 PID 1692 wrote to memory of 860 1692 coiome.exe 38 PID 860 wrote to memory of 2008 860 cmd.exe 40 PID 860 wrote to memory of 2008 860 cmd.exe 40 PID 860 wrote to memory of 2008 860 cmd.exe 40 PID 860 wrote to memory of 2008 860 cmd.exe 40 PID 1692 wrote to memory of 1936 1692 coiome.exe 41 PID 1692 wrote to memory of 1936 1692 coiome.exe 41 PID 1692 wrote to memory of 1936 1692 coiome.exe 41 PID 1692 wrote to memory of 1936 1692 coiome.exe 41 PID 1692 wrote to memory of 1116 1692 coiome.exe 43 PID 1692 wrote to memory of 1116 1692 coiome.exe 43 PID 1692 wrote to memory of 1116 1692 coiome.exe 43 PID 1692 wrote to memory of 1116 1692 coiome.exe 43 PID 1116 wrote to memory of 1804 1116 cmd.exe 46 PID 1116 wrote to memory of 1804 1116 cmd.exe 46 PID 1116 wrote to memory of 1804 1116 cmd.exe 46 PID 1116 wrote to memory of 1804 1116 cmd.exe 46 PID 1936 wrote to memory of 1076 1936 cmd.exe 45 PID 1936 wrote to memory of 1076 1936 cmd.exe 45 PID 1936 wrote to memory of 1076 1936 cmd.exe 45 PID 1936 wrote to memory of 1076 1936 cmd.exe 45 PID 1692 wrote to memory of 1228 1692 coiome.exe 47 PID 1692 wrote to memory of 1228 1692 coiome.exe 47 PID 1692 wrote to memory of 1228 1692 coiome.exe 47 PID 1692 wrote to memory of 1228 1692 coiome.exe 47 PID 1692 wrote to memory of 1032 1692 coiome.exe 49 PID 1692 wrote to memory of 1032 1692 coiome.exe 49 PID 1692 wrote to memory of 1032 1692 coiome.exe 49 PID 1692 wrote to memory of 1032 1692 coiome.exe 49 PID 1692 wrote to memory of 1972 1692 coiome.exe 51 PID 1692 wrote to memory of 1972 1692 coiome.exe 51 PID 1692 wrote to memory of 1972 1692 coiome.exe 51 PID 1692 wrote to memory of 1972 1692 coiome.exe 51 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1076 attrib.exe 1804 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DGT.hta"2⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1656
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /im coiome.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im coiome.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
-
C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe"C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd /c sc delete JavaServe3⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\sc.exesc delete JavaServe4⤵
- Launches sc.exe
PID:2008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -h -s -r -a "%userprofile%\Cookies\*.*"3⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\attrib.exeattrib -h -s -r -a "C:\Users\Admin\Cookies\*.*"4⤵
- Views/modifies file attributes
PID:1076
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -h -s -r -a "%userprofile%\Local Settings\Temp\Cookies\*.*"3⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\attrib.exeattrib -h -s -r -a "C:\Users\Admin\Local Settings\Temp\Cookies\*.*"4⤵
- Views/modifies file attributes
PID:1804
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del /f /s /q "%userprofile%\Cookies\*.*3⤵PID:1228
-
-
C:\Windows\SysWOW64\cmd.execmd /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"3⤵PID:1032
-
-
C:\Windows\SysWOW64\cmd.execmd /c del /f /s /q "%userprofile%\Local Settings\Temp\Cookies\*.*"3⤵PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"2⤵
- Deletes itself
PID:560
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD5c17abe22a67cde15e056ff1e6b4e548e
SHA1f56bb568c36003722c5d1955efb6c0ef38db758a
SHA256b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b
SHA5123e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9
-
Filesize
780B
MD5cfae0efb683986503bb789616bad8b55
SHA19325f503e9c4d97a7d06d81859f73d245a974753
SHA2568f1076023a3e05a05e9938b08398e885a516f7442a19cd0de7fd3a87f6c0ccd8
SHA512e338c41006f670cc98554f1c3a262cc7e4d9dd680bd9d77cc2b5a048a7f3b630f59df6a02fe6542df71647ce3eb7541f86bc3266fad396a9859620a7d26a942c
-
Filesize
12.1MB
MD5c17abe22a67cde15e056ff1e6b4e548e
SHA1f56bb568c36003722c5d1955efb6c0ef38db758a
SHA256b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b
SHA5123e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9
-
Filesize
12.1MB
MD5c17abe22a67cde15e056ff1e6b4e548e
SHA1f56bb568c36003722c5d1955efb6c0ef38db758a
SHA256b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b
SHA5123e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9