Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe
Resource
win10v2004-20221111-en
General
-
Target
d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe
-
Size
128KB
-
MD5
cd4e753034a975044e480b8428d30687
-
SHA1
726a772f4cec923d28c920c161cea0d223adcf43
-
SHA256
d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2
-
SHA512
dffdc6c276a443e4b170d2e21ddcfe4c67c5eec6a8e9bc6dff35bb9c2f6605fe3678d71701de33aa5590612d9142d19398600a15287f034b39d02634e8df9629
-
SSDEEP
3072:eDyjSDvi4wwDCXcsTlyrGn8Dq7E0zQL16Yirqn5zd32C:ktwwDMpErGnWq7E0zQL3i2n5zd
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mioqo.exe -
Executes dropped EXE 1 IoCs
pid Process 1856 mioqo.exe -
Loads dropped DLL 2 IoCs
pid Process 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /m" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /l" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /s" mioqo.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /i" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /g" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /q" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /e" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /h" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /j" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /d" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /n" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /b" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /o" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /p" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /k" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /z" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /f" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /x" mioqo.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /v" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /c" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /w" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /t" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /y" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /a" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /u" mioqo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /j" d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mioqo = "C:\\Users\\Admin\\mioqo.exe /r" mioqo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe 1856 mioqo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe 1856 mioqo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1472 wrote to memory of 1856 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe 28 PID 1472 wrote to memory of 1856 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe 28 PID 1472 wrote to memory of 1856 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe 28 PID 1472 wrote to memory of 1856 1472 d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe"C:\Users\Admin\AppData\Local\Temp\d130579dcc242543487c7e8bb03fa5f09cdf88c77ec70c680872fdf0e2d648c2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\mioqo.exe"C:\Users\Admin\mioqo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5e4578ba8a3f0a0b9ac714685097c4604
SHA119b481d7a2acb0920e69ec54fe07090a929e9c3a
SHA256955813b18245f17d9c60b027e22d763763ebcbcbe65869a7f8174c11fc592b63
SHA512a131fa8344247320e2f4104fa9eef705702909ed795696331aa12807839dfc8f93b8846d4a15dccb567490b35ce0542b1c551acae5a8c79d51a2c2328d821e86
-
Filesize
128KB
MD5e4578ba8a3f0a0b9ac714685097c4604
SHA119b481d7a2acb0920e69ec54fe07090a929e9c3a
SHA256955813b18245f17d9c60b027e22d763763ebcbcbe65869a7f8174c11fc592b63
SHA512a131fa8344247320e2f4104fa9eef705702909ed795696331aa12807839dfc8f93b8846d4a15dccb567490b35ce0542b1c551acae5a8c79d51a2c2328d821e86
-
Filesize
128KB
MD5e4578ba8a3f0a0b9ac714685097c4604
SHA119b481d7a2acb0920e69ec54fe07090a929e9c3a
SHA256955813b18245f17d9c60b027e22d763763ebcbcbe65869a7f8174c11fc592b63
SHA512a131fa8344247320e2f4104fa9eef705702909ed795696331aa12807839dfc8f93b8846d4a15dccb567490b35ce0542b1c551acae5a8c79d51a2c2328d821e86
-
Filesize
128KB
MD5e4578ba8a3f0a0b9ac714685097c4604
SHA119b481d7a2acb0920e69ec54fe07090a929e9c3a
SHA256955813b18245f17d9c60b027e22d763763ebcbcbe65869a7f8174c11fc592b63
SHA512a131fa8344247320e2f4104fa9eef705702909ed795696331aa12807839dfc8f93b8846d4a15dccb567490b35ce0542b1c551acae5a8c79d51a2c2328d821e86