Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
05/01/2023, 01:19
General
-
Target
AOMEI Partition Assistant 9.13.1 TE.exe
-
Size
31.4MB
-
MD5
2d32ebb9ed396390d62ead074ea08b35
-
SHA1
0b9ef7f639bf26d8c14b03ed87cd0d69a308916c
-
SHA256
7eae2737c72a73443f9f473c6eacd12b63e1a48acc37a4ab94c2b12a121620bf
-
SHA512
1fb7018fd4d994e7943ddaa8619d23b33b30716053cb63710df1e13c491a3f76637e4f750089eca0f22d50a06c456782bfd306cc37a8a2ca0a7ae57f63089b48
-
SSDEEP
786432:oSOKZJymumtv/Z+D8U+r98dfZBGvjx1sRkdn:pZJ8uZI0uZBG7iKn
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs .reg file with regedit 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AOMEI Partition Assistant 9.13.1 TE.exe"C:\Users\Admin\AppData\Local\Temp\AOMEI Partition Assistant 9.13.1 TE.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1GFT0.tmp\AOMEI Partition Assistant 9.13.1 TE.tmp"C:\Users\Admin\AppData\Local\Temp\is-1GFT0.tmp\AOMEI Partition Assistant 9.13.1 TE.tmp" /SL5="$10004A,32561984,67072,C:\Users\Admin\AppData\Local\Temp\AOMEI Partition Assistant 9.13.1 TE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe"C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe" -u3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe"C:\Program Files (x86)\AOMEI Partition Assistant\loaddrv.exe"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe"C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe" -u3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe"C:\Program Files (x86)\AOMEI Partition Assistant\ddm\loaddrv.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"3⤵
- Runs .reg file with regedit
-
-
C:\Users\Admin\AppData\Local\Temp\is-A08F6.tmp\path.exe"C:\Users\Admin\AppData\Local\Temp\is-A08F6.tmp\path.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD582bd642630764da26dc936a7b55717e9
SHA132dc58cfc5c2188d93bba1282c5053c20696774b
SHA2567bbdc868ae2044ec18d3e3ed921dbee08aef2a46b0b5ca61511041620b7bd1a8
SHA512df600acef2dce6cb2e496736d567ef1de89cd9fdc0b461a36a11ba1212dd6b245b81193512fa6ee2e6b69f8231a0cf8e5f85c712ecc4929dbc5a4f240f9e786d
-
Filesize
81KB
MD582bd642630764da26dc936a7b55717e9
SHA132dc58cfc5c2188d93bba1282c5053c20696774b
SHA2567bbdc868ae2044ec18d3e3ed921dbee08aef2a46b0b5ca61511041620b7bd1a8
SHA512df600acef2dce6cb2e496736d567ef1de89cd9fdc0b461a36a11ba1212dd6b245b81193512fa6ee2e6b69f8231a0cf8e5f85c712ecc4929dbc5a4f240f9e786d
-
Filesize
81KB
MD582bd642630764da26dc936a7b55717e9
SHA132dc58cfc5c2188d93bba1282c5053c20696774b
SHA2567bbdc868ae2044ec18d3e3ed921dbee08aef2a46b0b5ca61511041620b7bd1a8
SHA512df600acef2dce6cb2e496736d567ef1de89cd9fdc0b461a36a11ba1212dd6b245b81193512fa6ee2e6b69f8231a0cf8e5f85c712ecc4929dbc5a4f240f9e786d
-
Filesize
81KB
MD52580b3451f13144d9d1c77f9c90733a3
SHA1e68c7ea8017b501a37d4095556161263bc0fd0ef
SHA256d90631fec9db3b16c62567fe50ca14422e41b8e4d9af78a0c4129750230787f0
SHA512a973e580043edf562ab099a986a8d38ee4839216758435fb52dfaa0c3f1eee60f85a2063ac6ebefcef4d2bc21c2f5c7d1b624912ebe1f2c3ca6cec1082c3a3ab
-
Filesize
81KB
MD52580b3451f13144d9d1c77f9c90733a3
SHA1e68c7ea8017b501a37d4095556161263bc0fd0ef
SHA256d90631fec9db3b16c62567fe50ca14422e41b8e4d9af78a0c4129750230787f0
SHA512a973e580043edf562ab099a986a8d38ee4839216758435fb52dfaa0c3f1eee60f85a2063ac6ebefcef4d2bc21c2f5c7d1b624912ebe1f2c3ca6cec1082c3a3ab
-
Filesize
81KB
MD52580b3451f13144d9d1c77f9c90733a3
SHA1e68c7ea8017b501a37d4095556161263bc0fd0ef
SHA256d90631fec9db3b16c62567fe50ca14422e41b8e4d9af78a0c4129750230787f0
SHA512a973e580043edf562ab099a986a8d38ee4839216758435fb52dfaa0c3f1eee60f85a2063ac6ebefcef4d2bc21c2f5c7d1b624912ebe1f2c3ca6cec1082c3a3ab
-
Filesize
913KB
MD5dcf32d9a37d724112fa6203804404b73
SHA1291f264d8ead21086c47815c546abba0390c7a41
SHA25690a899b40d73a12d5991c7a66fec55d5b284e295cb921a8dc5a964eb0eda836d
SHA512bfd24ad9a11c2caa65c1629d1d9a5b00e10dd5b0f88776ffc18041f521b1ab853df4975fac11695f60a1e12b19f9b8c4de04dba82bdbbdcd83e0587aa2f9e518
-
Filesize
913KB
MD5dcf32d9a37d724112fa6203804404b73
SHA1291f264d8ead21086c47815c546abba0390c7a41
SHA25690a899b40d73a12d5991c7a66fec55d5b284e295cb921a8dc5a964eb0eda836d
SHA512bfd24ad9a11c2caa65c1629d1d9a5b00e10dd5b0f88776ffc18041f521b1ab853df4975fac11695f60a1e12b19f9b8c4de04dba82bdbbdcd83e0587aa2f9e518
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
631KB
MD5ce4576388e44cd74c3590fbbc988ba94
SHA1cd949eae19f8dd941b9842426bb70d855467c10f
SHA256bc86571f16f95450dea2fd9c74d3576308627d0336d5b4d600ed96671077c062
SHA51253d537376c295b12479abb6f312973eb137b3cc825403986ce70dbab1f72fd8bdf85c2c626c3e5c2558103510feda18acc55c282a9eb44255d07bc3c6112e63b
-
Filesize
631KB
MD5ce4576388e44cd74c3590fbbc988ba94
SHA1cd949eae19f8dd941b9842426bb70d855467c10f
SHA256bc86571f16f95450dea2fd9c74d3576308627d0336d5b4d600ed96671077c062
SHA51253d537376c295b12479abb6f312973eb137b3cc825403986ce70dbab1f72fd8bdf85c2c626c3e5c2558103510feda18acc55c282a9eb44255d07bc3c6112e63b
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
88KB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB