Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

Unhide.exe

windows7-x64

8

Unhide.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    126s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2023, 18:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Unhide.exe

  • Size

    668KB

  • MD5

    0c3717b91073d5e4a8097b69331646a5

  • SHA1

    1c3e14bf1b3b20736ca84f4d3a000dd8cbb84a59

  • SHA256

    28486a0eb0a65e2c926a44dc8559ccd6deec153b784d91698382512c82cdb401

  • SHA512

    a52ee1760327063b5bba79d6da74788d1971dce1466e94e0c4bf2a4283dcf662314635099a4ff885e50683a9817022ef4aec2d8bda23dc132f4ac4773252e564

  • SSDEEP

    12288:fxTCGTc6rYLF4s7E2vqsIG+OBxUkK3nn8eQ3Gj0Hy/23vc8/:pTlQ6rgPE2vagxdynMGjD/8vP

Score
8/10
ransomwareupx

Malware Config

Signatures

  • Drops file in Drivers directory 52 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 53 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 24 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unhide.exe
    "C:\Users\Admin\AppData\Local\Temp\Unhide.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\unhide.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
        SetPath
        3⤵
        • Executes dropped EXE
        PID:1712
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
        SED -r "s/ //g; s/\\\x22$/\x22/; s/^SET/@SET /I" SetPath00
        3⤵
        • Executes dropped EXE
        PID:1628
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c PEV VOLUME
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
          PEV VOLUME
          4⤵
          • Executes dropped EXE
          PID:1960
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -H C:\* /S /D
        3⤵
        • Drops file in Drivers directory
        • Modifies extensions of user files
        • Drops desktop.ini file(s)
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Views/modifies file attributes
        PID:1396
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
        PEV RIMPORT unhide.reg
        3⤵
          PID:1760
        • C:\Windows\SysWOW64\wscript.exe
          wscript "C:\Users\Admin\AppData\Local\Temp\info.vbs"
          3⤵
            PID:1576

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetPath.bat
        Filesize

        1KB

        MD5

        fa9f579295573245c0dc3cdaaf60bf2b

        SHA1

        37591c11f1356666051871a2c8036d9a5a3ae4db

        SHA256

        bc09e3042c50b5026c81095e580f92a3038956c7b81ef17da21abe32adb2f5d9

        SHA512

        131387b8f6ac1c6016a6ae91a11bb410b6e2e4fbbd90c390061a3c87eadb6383887838b5366e09449eb6cbb5673ffb4e8148a3985ce8afd9883431e7d6a01fbb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetPath00
        Filesize

        1KB

        MD5

        c1ceb071d0e649833148afd9c0cf9596

        SHA1

        ba75d10667038943831917a2026ba773e4f4a99b

        SHA256

        0e27e2865dbb2b7efd99c241c75a4eee199ee34b75f746da991bd9abce3302f7

        SHA512

        4eae4598850faabe498eaa9fb420eaecc9ad308688172821f35dabc3e203234cfe5a8443f37956d60c173e658618dea6fa25ba93af932dbba7b17a280ffe981e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\grep.exe
        Filesize

        78KB

        MD5

        9e05a9c264c8a908a8e79450fcbff047

        SHA1

        363b2ee171de15aeea793bd7fdffd68d0feb8ba4

        SHA256

        c2ef6fc419630d566154f8372e94859df8141d02805bc7bce39c726a1ffef7c1

        SHA512

        712892e9b08a22b795f9627f6d13412cb2a4610404de33c6f83a37178b920e7bb9d3042c3a2191e49d661a34a05202e18224c67811d8b52fa0fc2c757ef0f6fa

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
        Filesize

        249KB

        MD5

        3c33b26f2f7fa61d882515f2d6078691

        SHA1

        6a4327de077ea3126fc70c7031ca901383734562

        SHA256

        908fdb876715f0a77014a37396d9e964fa6359d98099929bab4086e66d72bb9f

        SHA512

        6682e012e0cf8a3a40873b15eee14dea5cc95e86b181632a5a2dff3498e1d8d6d01ced76efd08089d7e9d5c43ba64143639c0e5414143762a232e6dd964804d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
        Filesize

        249KB

        MD5

        3c33b26f2f7fa61d882515f2d6078691

        SHA1

        6a4327de077ea3126fc70c7031ca901383734562

        SHA256

        908fdb876715f0a77014a37396d9e964fa6359d98099929bab4086e66d72bb9f

        SHA512

        6682e012e0cf8a3a40873b15eee14dea5cc95e86b181632a5a2dff3498e1d8d6d01ced76efd08089d7e9d5c43ba64143639c0e5414143762a232e6dd964804d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
        Filesize

        249KB

        MD5

        3c33b26f2f7fa61d882515f2d6078691

        SHA1

        6a4327de077ea3126fc70c7031ca901383734562

        SHA256

        908fdb876715f0a77014a37396d9e964fa6359d98099929bab4086e66d72bb9f

        SHA512

        6682e012e0cf8a3a40873b15eee14dea5cc95e86b181632a5a2dff3498e1d8d6d01ced76efd08089d7e9d5c43ba64143639c0e5414143762a232e6dd964804d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
        Filesize

        96KB

        MD5

        2b657a67aebb84aea5632c53e61e23bf

        SHA1

        7d723cf82658da76bda85ae00bf20cb01b43edc8

        SHA256

        95a2e2cacfb63d095de385a98f1d5d4a21f0e7e8de485cbaf5b872434d43fb73

        SHA512

        16a68add6c2f6011c3c69dd3a3bf9496730c712e631c4992c19a83747020e8b560e3b93b08e95c536f245508a9c923f18488b2aef300acbe2ecedbe4ff3e5ca2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
        Filesize

        96KB

        MD5

        2b657a67aebb84aea5632c53e61e23bf

        SHA1

        7d723cf82658da76bda85ae00bf20cb01b43edc8

        SHA256

        95a2e2cacfb63d095de385a98f1d5d4a21f0e7e8de485cbaf5b872434d43fb73

        SHA512

        16a68add6c2f6011c3c69dd3a3bf9496730c712e631c4992c19a83747020e8b560e3b93b08e95c536f245508a9c923f18488b2aef300acbe2ecedbe4ff3e5ca2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
        Filesize

        26KB

        MD5

        4f5f4878c3931a5906392b6124ae0fcb

        SHA1

        5119a8d63258583365e7c6e082ccb8879901fd32

        SHA256

        399ce9f214fd0af7a0ff40e4c28d979642396f602845f7c6d8cb3020aa9f791e

        SHA512

        ce7d7768f5a35c907af7de745b83f27dba0173f4f107e4c2823a6f1bbf304079fe73f39b8b5807dd421c61a6cabe26272c671e7a940f68752ebfd71638b79299

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
        Filesize

        26KB

        MD5

        4f5f4878c3931a5906392b6124ae0fcb

        SHA1

        5119a8d63258583365e7c6e082ccb8879901fd32

        SHA256

        399ce9f214fd0af7a0ff40e4c28d979642396f602845f7c6d8cb3020aa9f791e

        SHA512

        ce7d7768f5a35c907af7de745b83f27dba0173f4f107e4c2823a6f1bbf304079fe73f39b8b5807dd421c61a6cabe26272c671e7a940f68752ebfd71638b79299

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\swxcacls.exe
        Filesize

        80KB

        MD5

        9cef63fde7a3a91a747ceb26d00fced3

        SHA1

        e32f3be159e7ed8ff722d7914e9bd76411f66f56

        SHA256

        8ddb40f126b0bac6095db82bd45bbe9b5d70b0a1e8542a82ab1df8031d776c9b

        SHA512

        5f1e0fd8a4f9131104f8cb58c91267026e126a4e832aee4e77ed2d4d8866e9b25406f02f17785c550661a58f9e11dbdd63ab784e9374d5cf7a42c5c7370763b0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\unhide.bat
        Filesize

        2KB

        MD5

        4427ca90cac3e5b4aff5e173ad2dd4f1

        SHA1

        9a33cc2a79676fb5f081cca6264aa4ad061058ea

        SHA256

        46efd6ebae7cbbb36b15b54cf409013172bf0fab6df92daefd9ea793d1fd30b2

        SHA512

        59bcc51f3a4d7826d1facf27ffa6207ede7bfae2a8a318514022af5bfd9f7063cfd730dec3bb0fe21dc67c6ab669b40afb42118ea4c9986b7e2534d7e0c4726c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\unhide.bat
        Filesize

        2KB

        MD5

        4427ca90cac3e5b4aff5e173ad2dd4f1

        SHA1

        9a33cc2a79676fb5f081cca6264aa4ad061058ea

        SHA256

        46efd6ebae7cbbb36b15b54cf409013172bf0fab6df92daefd9ea793d1fd30b2

        SHA512

        59bcc51f3a4d7826d1facf27ffa6207ede7bfae2a8a318514022af5bfd9f7063cfd730dec3bb0fe21dc67c6ab669b40afb42118ea4c9986b7e2534d7e0c4726c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\unhide.reg
        Filesize

        543B

        MD5

        fca6a5b2508b49f3363404a8e47d552a

        SHA1

        3ecd0d771baa100f4e1afa810bb3b1a27cd53aad

        SHA256

        609db8564ed67f25fb27d844c7ef2dfbc6bac0cf30eee127e2625e7583069804

        SHA512

        640571c86db7ef728bea66073ba35fe017d55edff124fe03deee41b1ff6e9f65bf4cad0fc465557e8ec0031e5eb4b414b8ebd1e3a1750622eadd841aefa1f9ef

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\info.vbs
        Filesize

        241B

        MD5

        fe5a00818eb15bc45e3c362fcc68d787

        SHA1

        23681ebfa9c200e4567dd9b3a2440408f5cdc870

        SHA256

        cc53502ef14619713c13ce195e8a74e3651504e9ff3335f18f4b29909c6cd4d4

        SHA512

        7fb517cf41257dc5c014547aa63c25995d96bc64afc3938f23922e7b22c6e95a6a669253ed927a81541a25b72d6bed27eaf0c967c7fde058739073231cfabef2

        Download Submit

      • \Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
        Filesize

        249KB

        MD5

        3c33b26f2f7fa61d882515f2d6078691

        SHA1

        6a4327de077ea3126fc70c7031ca901383734562

        SHA256

        908fdb876715f0a77014a37396d9e964fa6359d98099929bab4086e66d72bb9f

        SHA512

        6682e012e0cf8a3a40873b15eee14dea5cc95e86b181632a5a2dff3498e1d8d6d01ced76efd08089d7e9d5c43ba64143639c0e5414143762a232e6dd964804d2

        Download Submit

      • \Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
        Filesize

        249KB

        MD5

        3c33b26f2f7fa61d882515f2d6078691

        SHA1

        6a4327de077ea3126fc70c7031ca901383734562

        SHA256

        908fdb876715f0a77014a37396d9e964fa6359d98099929bab4086e66d72bb9f

        SHA512

        6682e012e0cf8a3a40873b15eee14dea5cc95e86b181632a5a2dff3498e1d8d6d01ced76efd08089d7e9d5c43ba64143639c0e5414143762a232e6dd964804d2

        Download Submit

      • \Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
        Filesize

        96KB

        MD5

        2b657a67aebb84aea5632c53e61e23bf

        SHA1

        7d723cf82658da76bda85ae00bf20cb01b43edc8

        SHA256

        95a2e2cacfb63d095de385a98f1d5d4a21f0e7e8de485cbaf5b872434d43fb73

        SHA512

        16a68add6c2f6011c3c69dd3a3bf9496730c712e631c4992c19a83747020e8b560e3b93b08e95c536f245508a9c923f18488b2aef300acbe2ecedbe4ff3e5ca2

        Download Submit

      • \Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
        Filesize

        96KB

        MD5

        2b657a67aebb84aea5632c53e61e23bf

        SHA1

        7d723cf82658da76bda85ae00bf20cb01b43edc8

        SHA256

        95a2e2cacfb63d095de385a98f1d5d4a21f0e7e8de485cbaf5b872434d43fb73

        SHA512

        16a68add6c2f6011c3c69dd3a3bf9496730c712e631c4992c19a83747020e8b560e3b93b08e95c536f245508a9c923f18488b2aef300acbe2ecedbe4ff3e5ca2

        Download Submit

      • \Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
        Filesize

        26KB

        MD5

        4f5f4878c3931a5906392b6124ae0fcb

        SHA1

        5119a8d63258583365e7c6e082ccb8879901fd32

        SHA256

        399ce9f214fd0af7a0ff40e4c28d979642396f602845f7c6d8cb3020aa9f791e

        SHA512

        ce7d7768f5a35c907af7de745b83f27dba0173f4f107e4c2823a6f1bbf304079fe73f39b8b5807dd421c61a6cabe26272c671e7a940f68752ebfd71638b79299

        Download Submit

      • \Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
        Filesize

        26KB

        MD5

        4f5f4878c3931a5906392b6124ae0fcb

        SHA1

        5119a8d63258583365e7c6e082ccb8879901fd32

        SHA256

        399ce9f214fd0af7a0ff40e4c28d979642396f602845f7c6d8cb3020aa9f791e

        SHA512

        ce7d7768f5a35c907af7de745b83f27dba0173f4f107e4c2823a6f1bbf304079fe73f39b8b5807dd421c61a6cabe26272c671e7a940f68752ebfd71638b79299

        Download Submit

      • memory/540-130-0x0000000000170000-0x0000000000185000-memory.dmp

        Filesize

        84KB

        Download

      • memory/1628-88-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/1636-129-0x0000000000400000-0x0000000000487000-memory.dmp

        Filesize

        540KB

        Download

      • memory/1636-158-0x0000000000400000-0x0000000000487000-memory.dmp

        Filesize

        540KB

        Download

      • memory/1712-80-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

        Download

      • memory/1760-153-0x00000000010D0000-0x00000000011A0000-memory.dmp

        Filesize

        832KB

        Download

      • memory/1760-154-0x0000000000030000-0x0000000000033000-memory.dmp

        Filesize

        12KB

        Download

      • memory/1960-135-0x0000000000030000-0x0000000000033000-memory.dmp

        Filesize

        12KB

        Download

      • memory/1960-134-0x00000000002B0000-0x0000000000380000-memory.dmp

        Filesize

        832KB

        Download