Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
06/02/2023, 04:25
General
-
Target
uiso9_pe.exe
-
Size
4.9MB
-
MD5
5a2000a241a6947c060ee63425d7ebef
-
SHA1
d80bbe4769b5e00886797d6f7c30063031eb5699
-
SHA256
5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236
-
SHA512
cf4155b56d878d1d4c8b18669d6aa700c626fa5b2f67719bb8b2f8378059003046f437ae223a7aef6336d95cb82eeeb057910a432c135bbc4d94619a8bbfde1a
-
SSDEEP
98304:JUj8/4MycvvCf9uOj5zXSdcrRsMZtuS0xbN0yjqnolKIMPgZrx/CpSSMD/zCDK8:Oj3MychOBXSdclsotcYyEGMPqrxo0zCP
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 9 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 60 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OJHFP.tmp\uiso9_pe.tmp"C:\Users\Admin\AppData\Local\Temp\is-OJHFP.tmp\uiso9_pe.tmp" /SL5="$70126,4629041,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\UltraISO\drivers\isocmd.exe"C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\UltraISO\Readme.txt3⤵
-
-
C:\Program Files (x86)\UltraISO\UltraISO.exe"C:\Program Files (x86)\UltraISO\UltraISO.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5541⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
962KB
MD5b9e34ae6d6ecb1e19b36dc70e7ef406c
SHA1014985ed2dab57e606e08788fc9177220dd2aed1
SHA2563b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4
SHA512d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2
-
Filesize
2KB
MD5bff30d893fc39cf16544a3ae18e72d33
SHA1027219b92ade452de2757d5460618a73c3ab7aa7
SHA256904e402e59d1b093378516064bffb2a7d06fb53c1422615724292640cb2f7c0a
SHA512f56cc68b15b0e17fa15e4d8cf4c22995a2a3dc46c2201143fa86195088a64fa2c3b54d587b481d1f219ea894c1e09d9ecd254f2189dede94bdb7a6d4348a6945
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
112KB
MD5e489d12ff435aeef4a5474c47d329590
SHA117c353b5748ecd3e8eedd9de347da313085087dc
SHA25666a01f63ee4f66c0cd5bb9bf20e1722d57cc8252ac126780800806b536f4cea9
SHA51226582a140080e64d7f46b83435a8f2444c509e6a5dfaa1fd4adc190824daecfc5464e56ca89cb0518bcec780a1a16700199e567543cea32f32c5ca3e47add2fc
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
151KB
MD5c0fc6c67bd9d9fbc4f8ad44232d49d11
SHA1e5ad2b56cc20652401ee5c60fe118cf3fb474a7b
SHA25650df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503
SHA51274bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6
-
Filesize
962KB
MD5b9e34ae6d6ecb1e19b36dc70e7ef406c
SHA1014985ed2dab57e606e08788fc9177220dd2aed1
SHA2563b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4
SHA512d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
5.2MB
MD563285e1d8a23ad23dd5b163feb715059
SHA167ee1910b3dd150a1297367dacdb4b272db01644
SHA256116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be
SHA512d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
28KB
MD555677a521dd34ce7a93ab3f1d12b2dfd
SHA14316dd2b5e4ebb48886955ec5365b2f40d4298b3
SHA256fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c
SHA512e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc
-
Filesize
151KB
MD5c0fc6c67bd9d9fbc4f8ad44232d49d11
SHA1e5ad2b56cc20652401ee5c60fe118cf3fb474a7b
SHA25650df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503
SHA51274bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586
-
Filesize
782KB
MD5f92f7190cab7f80cbd7f5e419c27e37d
SHA18b26411b33a8727353ac615c11acdfebc34fad80
SHA25682190e1bfe62f4549f3ca2dd76261cc6213968d4f599349d3b07274499223ece
SHA512922ead325d49738ecd3ad93aec573649da5a9082892aeeb63cfdaa0f0c5141844a86bae666b3279303b0b1684e93433b62f734c52c77c94633bd6a508f7480dc
-
Filesize
771KB
MD53de2992c86c78e781881e9c0db26a32f
SHA1c26845ca7319a66432304a955cecdad4f977d040
SHA256e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642
SHA51288d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
152KB
-
Filesize
8KB
-
Filesize
152KB
-
Filesize
152KB