Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 03:05
Static task
static1
Behavioral task
behavioral1
Sample
3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe
-
Size
176KB
-
MD5
60705b6e4ee220477320bcf4111c1830
-
SHA1
d6a1c4f31414c55f2171c4d766d600ba96a307fb
-
SHA256
3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69
-
SHA512
f81dba47198250c02dfbe93bbf45f062ebd5e69a8e8da878994178232035f5237be640ad44c9e9954e87f5dcb833d6cc4133b3e3c708014ae0e84bd679004844
-
SSDEEP
3072:yfRNa4/jynvgWK/fObT/bGiSEIGsbv0OpxYTNPybtDKvS3i:ujG3K/fObT/bGiSE5sj3xYTNPybtDKv9
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" moika.exe -
Executes dropped EXE 1 IoCs
pid Process 1712 moika.exe -
Loads dropped DLL 2 IoCs
pid Process 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe -
Adds Run key to start application 2 TTPs 43 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /g" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /Y" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /H" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /q" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /w" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /L" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /a" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /J" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /z" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /h" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /p" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /s" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /P" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /e" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /v" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /Q" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /E" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /B" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /G" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /o" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /Z" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /m" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /y" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /N" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /f" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /D" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /W" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /M" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /k" moika.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /t" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /R" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /K" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /c" 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /X" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /c" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /A" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /i" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /l" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /x" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /u" moika.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\moika = "C:\\Users\\Admin\\moika.exe /U" moika.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe 1712 moika.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe 1712 moika.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 832 wrote to memory of 1712 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe 28 PID 832 wrote to memory of 1712 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe 28 PID 832 wrote to memory of 1712 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe 28 PID 832 wrote to memory of 1712 832 3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe"C:\Users\Admin\AppData\Local\Temp\3312c2e56d4e8e0bfd2cc78fa1b38c2954d360a473858d8b3e08ebe355278a69.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\moika.exe"C:\Users\Admin\moika.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD537db4442978620234a482cec220fe7c5
SHA128e7494178a7c665f42c733e847677f733c39e7e
SHA2560202fd0f489b9c22e2f267a2e29c0df65b9e9b7c0d721d6e6efcd32bda5143e8
SHA51216326e6244329d9ad0c3f309ab6531ac48a8b1a439e45258a16eeaf99c72b79543acb42a1ea1067c692821f61c6df20b91238533044d3f28fcbacc113ccdabc8
-
Filesize
176KB
MD537db4442978620234a482cec220fe7c5
SHA128e7494178a7c665f42c733e847677f733c39e7e
SHA2560202fd0f489b9c22e2f267a2e29c0df65b9e9b7c0d721d6e6efcd32bda5143e8
SHA51216326e6244329d9ad0c3f309ab6531ac48a8b1a439e45258a16eeaf99c72b79543acb42a1ea1067c692821f61c6df20b91238533044d3f28fcbacc113ccdabc8
-
Filesize
176KB
MD537db4442978620234a482cec220fe7c5
SHA128e7494178a7c665f42c733e847677f733c39e7e
SHA2560202fd0f489b9c22e2f267a2e29c0df65b9e9b7c0d721d6e6efcd32bda5143e8
SHA51216326e6244329d9ad0c3f309ab6531ac48a8b1a439e45258a16eeaf99c72b79543acb42a1ea1067c692821f61c6df20b91238533044d3f28fcbacc113ccdabc8
-
Filesize
176KB
MD537db4442978620234a482cec220fe7c5
SHA128e7494178a7c665f42c733e847677f733c39e7e
SHA2560202fd0f489b9c22e2f267a2e29c0df65b9e9b7c0d721d6e6efcd32bda5143e8
SHA51216326e6244329d9ad0c3f309ab6531ac48a8b1a439e45258a16eeaf99c72b79543acb42a1ea1067c692821f61c6df20b91238533044d3f28fcbacc113ccdabc8