Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/02/2023, 06:18

General

  • Target

    uiso9_pe.exe

  • Size

    4.9MB

  • MD5

    5a2000a241a6947c060ee63425d7ebef

  • SHA1

    d80bbe4769b5e00886797d6f7c30063031eb5699

  • SHA256

    5f26ba6ce5a487a3c9ec7663143f6d661c5500d0dd593274bd4ab6e78815d236

  • SHA512

    cf4155b56d878d1d4c8b18669d6aa700c626fa5b2f67719bb8b2f8378059003046f437ae223a7aef6336d95cb82eeeb057910a432c135bbc4d94619a8bbfde1a

  • SSDEEP

    98304:JUj8/4MycvvCf9uOj5zXSdcrRsMZtuS0xbN0yjqnolKIMPgZrx/CpSSMD/zCDK8:Oj3MychOBXSdclsotcYyEGMPqrxo0zCP

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 60 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe
    "C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\is-DSMC4.tmp\uiso9_pe.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DSMC4.tmp\uiso9_pe.tmp" /SL5="$70122,4629041,128512,C:\Users\Admin\AppData\Local\Temp\uiso9_pe.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UltraISO\isoshl64.dll"
        3⤵
        • Loads dropped DLL
        • Registers COM server for autorun
        • Modifies registry class
        PID:580
      • C:\Program Files (x86)\UltraISO\drivers\isocmd.exe
        "C:\Program Files (x86)\UltraISO\drivers\isocmd.exe" -i
        3⤵
        • Executes dropped EXE
        PID:1664
      • C:\Program Files (x86)\UltraISO\UltraISO.exe
        "C:\Program Files (x86)\UltraISO\UltraISO.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:1636
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x568
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:632

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\EZB Systems\lame_enc.dll

    Filesize

    962KB

    MD5

    b9e34ae6d6ecb1e19b36dc70e7ef406c

    SHA1

    014985ed2dab57e606e08788fc9177220dd2aed1

    SHA256

    3b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4

    SHA512

    d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2

  • C:\Program Files (x86)\UltraISO\UltraISO.exe

    Filesize

    5.2MB

    MD5

    63285e1d8a23ad23dd5b163feb715059

    SHA1

    67ee1910b3dd150a1297367dacdb4b272db01644

    SHA256

    116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be

    SHA512

    d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7

  • C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys

    Filesize

    112KB

    MD5

    e489d12ff435aeef4a5474c47d329590

    SHA1

    17c353b5748ecd3e8eedd9de347da313085087dc

    SHA256

    66a01f63ee4f66c0cd5bb9bf20e1722d57cc8252ac126780800806b536f4cea9

    SHA512

    26582a140080e64d7f46b83435a8f2444c509e6a5dfaa1fd4adc190824daecfc5464e56ca89cb0518bcec780a1a16700199e567543cea32f32c5ca3e47add2fc

  • C:\Program Files (x86)\UltraISO\drivers\IsoCmd.exe

    Filesize

    28KB

    MD5

    55677a521dd34ce7a93ab3f1d12b2dfd

    SHA1

    4316dd2b5e4ebb48886955ec5365b2f40d4298b3

    SHA256

    fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c

    SHA512

    e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc

  • C:\Program Files (x86)\UltraISO\isoshl64.dll

    Filesize

    151KB

    MD5

    c0fc6c67bd9d9fbc4f8ad44232d49d11

    SHA1

    e5ad2b56cc20652401ee5c60fe118cf3fb474a7b

    SHA256

    50df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503

    SHA512

    74bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586

  • C:\Users\Admin\AppData\Local\Temp\is-DSMC4.tmp\uiso9_pe.tmp

    Filesize

    771KB

    MD5

    3de2992c86c78e781881e9c0db26a32f

    SHA1

    c26845ca7319a66432304a955cecdad4f977d040

    SHA256

    e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

    SHA512

    88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

  • C:\Users\Admin\AppData\Local\Temp\is-DSMC4.tmp\uiso9_pe.tmp

    Filesize

    771KB

    MD5

    3de2992c86c78e781881e9c0db26a32f

    SHA1

    c26845ca7319a66432304a955cecdad4f977d040

    SHA256

    e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

    SHA512

    88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

  • \Program Files (x86)\Common Files\EZB Systems\lame_enc.dll

    Filesize

    962KB

    MD5

    b9e34ae6d6ecb1e19b36dc70e7ef406c

    SHA1

    014985ed2dab57e606e08788fc9177220dd2aed1

    SHA256

    3b8817fad300fd729d28ca4895d9fb131cf64e699fe5de658ae44c6d056dace4

    SHA512

    d2360eb205a7f8feb9d45237f0190ef3b2444b22225bead9eedfe5301cac0601741a7d849033d3b2b5cd2a39496edc86e1d4d4444110bafefcf4a8922c6bbff2

  • \Program Files (x86)\UltraISO\UltraISO.exe

    Filesize

    5.2MB

    MD5

    63285e1d8a23ad23dd5b163feb715059

    SHA1

    67ee1910b3dd150a1297367dacdb4b272db01644

    SHA256

    116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be

    SHA512

    d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7

  • \Program Files (x86)\UltraISO\UltraISO.exe

    Filesize

    5.2MB

    MD5

    63285e1d8a23ad23dd5b163feb715059

    SHA1

    67ee1910b3dd150a1297367dacdb4b272db01644

    SHA256

    116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be

    SHA512

    d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7

  • \Program Files (x86)\UltraISO\UltraISO.exe

    Filesize

    5.2MB

    MD5

    63285e1d8a23ad23dd5b163feb715059

    SHA1

    67ee1910b3dd150a1297367dacdb4b272db01644

    SHA256

    116033b8e66845a6db4c97a134464254034228ad937e2610066e1b6a759018be

    SHA512

    d296a019aa558e7678188277e4e83fa451add9a9e3629e0a4665565764de26e6a9806feb6d69534308907556421c94cbc4c802db04f2cf87a3a1fb3765e09fe7

  • \Program Files (x86)\UltraISO\drivers\IsoCmd.exe

    Filesize

    28KB

    MD5

    55677a521dd34ce7a93ab3f1d12b2dfd

    SHA1

    4316dd2b5e4ebb48886955ec5365b2f40d4298b3

    SHA256

    fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c

    SHA512

    e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc

  • \Program Files (x86)\UltraISO\drivers\IsoCmd.exe

    Filesize

    28KB

    MD5

    55677a521dd34ce7a93ab3f1d12b2dfd

    SHA1

    4316dd2b5e4ebb48886955ec5365b2f40d4298b3

    SHA256

    fc506cb2ce0fa9a994db2e29a595f818fe93cae93dd2f8cca6f4b40944907c5c

    SHA512

    e4e05c49701865ba349f4c037c96539cfd3da1f8cd97f9668474ca50a50db0a50e59e7f21f7e0fbc44ca1f79f7cdb529f82bc70b2a7a34e861bb5350ee783dcc

  • \Program Files (x86)\UltraISO\isoshl64.dll

    Filesize

    151KB

    MD5

    c0fc6c67bd9d9fbc4f8ad44232d49d11

    SHA1

    e5ad2b56cc20652401ee5c60fe118cf3fb474a7b

    SHA256

    50df2e7ba2ab1892dd1e8c03be51a1dfa9c1ecc501d5166cd5e69badb4a8c503

    SHA512

    74bc8d2d93c870f0449582b6de60ade9b0322a5cca945beac8842ccd4577569ea97a7089163dcff8b0115ebbaf2ae75d09ae5214efcb8ea6902c80a2cc0e5586

  • \Program Files (x86)\UltraISO\unins000.exe

    Filesize

    782KB

    MD5

    f92f7190cab7f80cbd7f5e419c27e37d

    SHA1

    8b26411b33a8727353ac615c11acdfebc34fad80

    SHA256

    82190e1bfe62f4549f3ca2dd76261cc6213968d4f599349d3b07274499223ece

    SHA512

    922ead325d49738ecd3ad93aec573649da5a9082892aeeb63cfdaa0f0c5141844a86bae666b3279303b0b1684e93433b62f734c52c77c94633bd6a508f7480dc

  • \Users\Admin\AppData\Local\Temp\is-DSMC4.tmp\uiso9_pe.tmp

    Filesize

    771KB

    MD5

    3de2992c86c78e781881e9c0db26a32f

    SHA1

    c26845ca7319a66432304a955cecdad4f977d040

    SHA256

    e9700438d88e5a5f54d6940a4129477e943dcd4b95b006d0b38ef1e2a566a642

    SHA512

    88d318e3265ac733408836592f87349a7bd2be1ae34e92ef7bd302926ff69b4a072300d5eac07cffdf91929b24ae08818c7cfb42cc825afaacd29250f7cae6a6

  • memory/580-68-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp

    Filesize

    8KB

  • memory/1716-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

    Filesize

    8KB

  • memory/1716-61-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1716-80-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1716-55-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2040-62-0x0000000074761000-0x0000000074763000-memory.dmp

    Filesize

    8KB