Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-es -
resource tags
-
submitted
25/01/2023, 21:16
General
-
Target
uiso9_pe.exe
-
Size
4.9MB
-
MD5
5a2000a241a6947c060ee63425d7ebef
-
SHA1
d80bbe4769b5e00886797d6f7c30063031eb5699
-
SHA256
5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236
-
SHA512
cf4155b56d878d1d4c8b18669d6aa700c626fa5b2f67719bb8b2f8378059003046f437ae223a7aef6336d95cb82eeeb057910a432c135bbc4d94619a8bbfde1a
-
SSDEEP
98304:JUj8/4MycvvCf9uOj5zXSdcrRsMZtuS0xbN0yjqnolKIMPgZrx/CpSSMD/zCDK8:Oj3MychOBXSdclsotcYyEGMPqrxo0zCP
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 60 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GK7PU.tmp\uiso9_pe.tmp"C:\Users\Admin\AppData\Local\Temp\is-GK7PU.tmp\uiso9_pe.tmp" /SL5="$701C2,4629041,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\UltraISO\drivers\isocmd.exe"C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\UltraISO\UltraISO.exe"C:\Program Files (x86)\UltraISO\UltraISO.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\UltraISO\drivers\FileDlg.exe"C:\Program Files (x86)\UltraISO\drivers\FileDlg.exe" -o -m004⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x454 0x2b81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
962KB
MD5b9e34ae6d6ecb1e19b36dc70e7ef406c
SHA1014985ed2dab57e606e08788fc9177220dd2aed1
SHA2563b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4
SHA512d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2
-
Filesize
962KB
MD5b9e34ae6d6ecb1e19b36dc70e7ef406c
SHA1014985ed2dab57e606e08788fc9177220dd2aed1
SHA2563b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4
SHA512d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
83KB
MD5b1cd3f9e805d2225133ba99ca93d34bc
SHA144d16b2677eec775b99ac6c85a6a7f533e0d5550
SHA2562fa5c3457aacb299886d27254a5da71d4b7715c41ed57f10a492b48e8f8f37c5
SHA5121efdeec7194bd99697e27c1fa042a728ee3acc6e048ac0e1ce47ca21994ea4907c6ce901cfa8c757e08c06719da12171168d6f10d5b8f20c1d8942c49a3fb3a4
-
Filesize
83KB
MD5b1cd3f9e805d2225133ba99ca93d34bc
SHA144d16b2677eec775b99ac6c85a6a7f533e0d5550
SHA2562fa5c3457aacb299886d27254a5da71d4b7715c41ed57f10a492b48e8f8f37c5
SHA5121efdeec7194bd99697e27c1fa042a728ee3acc6e048ac0e1ce47ca21994ea4907c6ce901cfa8c757e08c06719da12171168d6f10d5b8f20c1d8942c49a3fb3a4
-
Filesize
132KB
MD5bc81814b594286bef9913ec5ca1110d7
SHA1523fc3b657fd3fb493e0fb14c0bbf39813d1e558
SHA2569c22b6f77e929d319c5e891ee1510045dc5f486bdaf47a0696564d4d84d30379
SHA5122b65dc57a4c83c1ef243396dabf15cf53faa145bd073ac89dbf9104519e7a2b97a303c96acfdbc992e9ac19efbe65b143dd27bb6c9f7ad3e76c5eacb1b9a1889
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
151KB
MD5c0fc6c67bd9d9fbc4f8ad44232d49d11
SHA1e5ad2b56cc20652401ee5c60fe118cf3fb474a7b
SHA25650df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503
SHA51274bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586
-
Filesize
151KB
MD5c0fc6c67bd9d9fbc4f8ad44232d49d11
SHA1e5ad2b56cc20652401ee5c60fe118cf3fb474a7b
SHA25650df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503
SHA51274bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586
-
Filesize
97KB
MD5ec7a301cfad8f58bebe45d61f2943b07
SHA192762f1d791231e587fbde2b0a48170fe5189965
SHA2567ce977e96f7b52367ed4219077a986db6e08d617067829d2836f2d80d70920af
SHA512f3fef24763a31864228cec64d933585dc71db33f49fcff6a90796798708c1980c9d1910f084762da1cb9173905a67f8f511af7fe76ca01058e828fa133f98700
-
Filesize
97KB
MD5ec7a301cfad8f58bebe45d61f2943b07
SHA192762f1d791231e587fbde2b0a48170fe5189965
SHA2567ce977e96f7b52367ed4219077a986db6e08d617067829d2836f2d80d70920af
SHA512f3fef24763a31864228cec64d933585dc71db33f49fcff6a90796798708c1980c9d1910f084762da1cb9173905a67f8f511af7fe76ca01058e828fa133f98700
-
Filesize
97KB
MD5ec7a301cfad8f58bebe45d61f2943b07
SHA192762f1d791231e587fbde2b0a48170fe5189965
SHA2567ce977e96f7b52367ed4219077a986db6e08d617067829d2836f2d80d70920af
SHA512f3fef24763a31864228cec64d933585dc71db33f49fcff6a90796798708c1980c9d1910f084762da1cb9173905a67f8f511af7fe76ca01058e828fa133f98700
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6
-
Filesize
104KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB