Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 09:45
Static task
static1
Behavioral task
behavioral1
Sample
8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe
-
Size
152KB
-
MD5
07372a0e39dbe8b9d656591d309dbafd
-
SHA1
57be6503c58863076522afffca47f1c661f5c3c5
-
SHA256
8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03
-
SHA512
9d1501c277054747245bf6f541290cf26d60387d3daf4f6f568e6e3a3b21b86ee47501af0fb2a470f918001c4cf7122c3988e75f318c0c1001f87910251ed1d2
-
SSDEEP
3072:kml0PTYhjIgF+7MxJUbaxI3zQyzLBuT+u3:FF+7Mxa0yzE
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeuifo.exe -
Executes dropped EXE 1 IoCs
pid Process 1668 zeuifo.exe -
Loads dropped DLL 2 IoCs
pid Process 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /D" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /o" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /e" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /E" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /P" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /Q" zeuifo.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /d" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /i" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /T" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /w" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /S" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /k" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /z" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /p" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /m" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /O" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /W" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /c" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /a" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /N" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /H" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /A" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /y" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /l" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /j" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /n" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /K" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /G" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /V" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /X" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /u" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /f" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /F" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /I" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /Z" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /J" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /Y" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /g" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /r" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /M" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /C" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /B" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /L" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /U" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /v" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /x" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /q" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /z" 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /t" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /R" zeuifo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeuifo = "C:\\Users\\Admin\\zeuifo.exe /b" zeuifo.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe 1668 zeuifo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe 1668 zeuifo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1668 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe 28 PID 1224 wrote to memory of 1668 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe 28 PID 1224 wrote to memory of 1668 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe 28 PID 1224 wrote to memory of 1668 1224 8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe"C:\Users\Admin\AppData\Local\Temp\8b351636c5600645a2f4570831bcad92795cc88f8cba85a4e52d29153ad75d03.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\zeuifo.exe"C:\Users\Admin\zeuifo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1668
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD56ef4667c94c76bd0365e8f967ba8e58a
SHA188756d4ffa0e14e9291ee8728d4f3ef37063e045
SHA256f4e7df5b241a9fd8f9b9bead89646a544e80c0fe3de65ac7c71502456a5e88da
SHA5121d7c3293597327ee9bc1ce4504988f48ecaa873e280ca58ea9e2eaf8bb85b4a28d34f876a32da8d6196b864156cabec25b15a77ea0c8ffe0c52cd7d08bdf708d
-
Filesize
152KB
MD56ef4667c94c76bd0365e8f967ba8e58a
SHA188756d4ffa0e14e9291ee8728d4f3ef37063e045
SHA256f4e7df5b241a9fd8f9b9bead89646a544e80c0fe3de65ac7c71502456a5e88da
SHA5121d7c3293597327ee9bc1ce4504988f48ecaa873e280ca58ea9e2eaf8bb85b4a28d34f876a32da8d6196b864156cabec25b15a77ea0c8ffe0c52cd7d08bdf708d
-
Filesize
152KB
MD56ef4667c94c76bd0365e8f967ba8e58a
SHA188756d4ffa0e14e9291ee8728d4f3ef37063e045
SHA256f4e7df5b241a9fd8f9b9bead89646a544e80c0fe3de65ac7c71502456a5e88da
SHA5121d7c3293597327ee9bc1ce4504988f48ecaa873e280ca58ea9e2eaf8bb85b4a28d34f876a32da8d6196b864156cabec25b15a77ea0c8ffe0c52cd7d08bdf708d
-
Filesize
152KB
MD56ef4667c94c76bd0365e8f967ba8e58a
SHA188756d4ffa0e14e9291ee8728d4f3ef37063e045
SHA256f4e7df5b241a9fd8f9b9bead89646a544e80c0fe3de65ac7c71502456a5e88da
SHA5121d7c3293597327ee9bc1ce4504988f48ecaa873e280ca58ea9e2eaf8bb85b4a28d34f876a32da8d6196b864156cabec25b15a77ea0c8ffe0c52cd7d08bdf708d