Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

Unhide.exe

windows7-x64

8

Unhide.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2023, 18:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Unhide.exe

  • Size

    668KB

  • MD5

    0c3717b91073d5e4a8097b69331646a5

  • SHA1

    1c3e14bf1b3b20736ca84f4d3a000dd8cbb84a59

  • SHA256

    28486a0eb0a65e2c926a44dc8559ccd6deec153b784d91698382512c82cdb401

  • SHA512

    a52ee1760327063b5bba79d6da74788d1971dce1466e94e0c4bf2a4283dcf662314635099a4ff885e50683a9817022ef4aec2d8bda23dc132f4ac4773252e564

  • SSDEEP

    12288:fxTCGTc6rYLF4s7E2vqsIG+OBxUkK3nn8eQ3Gj0Hy/23vc8/:pTlQ6rgPE2vagxdynMGjD/8vP

Score
8/10
ransomwareupx

Malware Config

Signatures

  • Drops file in Drivers directory 29 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 34 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 18 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Unhide.exe
    "C:\Users\Admin\AppData\Local\Temp\Unhide.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\unhide.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3696
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
        SetPath
        3⤵
        • Executes dropped EXE
        PID:4240
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
        SED -r "s/ //g; s/\\\x22$/\x22/; s/^SET/@SET /I" SetPath00
        3⤵
        • Executes dropped EXE
        PID:2012
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c PEV VOLUME
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
          PEV VOLUME
          4⤵
          • Executes dropped EXE
          PID:4440
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -H C:\* /S /D
        3⤵
        • Drops file in Drivers directory
        • Modifies extensions of user files
        • Drops desktop.ini file(s)
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Views/modifies file attributes
        PID:4860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetPath.bat
    Filesize

    1KB

    MD5

    d801958ceae5f70610b496d9b470c226

    SHA1

    3e6c19fd4c825909837c6a539f1062b7100abbe2

    SHA256

    4ed7c723e6216df05b21537c08e466be504af76bac2cbc04ffc37aa96935b21b

    SHA512

    f1d26e4c777978697141324e26aefa5a870e170c545605892505d5cfdab901ea385897d7037c538932e1933f9b810b6c31cd1c4d4ed8f61af75225394c7afce0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SetPath00
    Filesize

    1KB

    MD5

    67a7e99522b111d938759305c5b77fe2

    SHA1

    a14819fb35b3ece5e69648af8555022c9254471d

    SHA256

    458fae2d4a72e9563b3519070d287cafba688fe61a400130975c9dc47c72793d

    SHA512

    40cb88ab4109ffe8abe5f81056a62aecd322a0e6331fe6f44559a92632f9c6d98ec409b2434e4e7e27add47525307b7f659b9a2be0f62b8af8e5565ddc163640

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\grep.exe
    Filesize

    78KB

    MD5

    9e05a9c264c8a908a8e79450fcbff047

    SHA1

    363b2ee171de15aeea793bd7fdffd68d0feb8ba4

    SHA256

    c2ef6fc419630d566154f8372e94859df8141d02805bc7bce39c726a1ffef7c1

    SHA512

    712892e9b08a22b795f9627f6d13412cb2a4610404de33c6f83a37178b920e7bb9d3042c3a2191e49d661a34a05202e18224c67811d8b52fa0fc2c757ef0f6fa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
    Filesize

    249KB

    MD5

    3c33b26f2f7fa61d882515f2d6078691

    SHA1

    6a4327de077ea3126fc70c7031ca901383734562

    SHA256

    908fdb876715f0a77014a37396d9e964fa6359d98099929bab4086e66d72bb9f

    SHA512

    6682e012e0cf8a3a40873b15eee14dea5cc95e86b181632a5a2dff3498e1d8d6d01ced76efd08089d7e9d5c43ba64143639c0e5414143762a232e6dd964804d2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\pev.exe
    Filesize

    249KB

    MD5

    3c33b26f2f7fa61d882515f2d6078691

    SHA1

    6a4327de077ea3126fc70c7031ca901383734562

    SHA256

    908fdb876715f0a77014a37396d9e964fa6359d98099929bab4086e66d72bb9f

    SHA512

    6682e012e0cf8a3a40873b15eee14dea5cc95e86b181632a5a2dff3498e1d8d6d01ced76efd08089d7e9d5c43ba64143639c0e5414143762a232e6dd964804d2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
    Filesize

    96KB

    MD5

    2b657a67aebb84aea5632c53e61e23bf

    SHA1

    7d723cf82658da76bda85ae00bf20cb01b43edc8

    SHA256

    95a2e2cacfb63d095de385a98f1d5d4a21f0e7e8de485cbaf5b872434d43fb73

    SHA512

    16a68add6c2f6011c3c69dd3a3bf9496730c712e631c4992c19a83747020e8b560e3b93b08e95c536f245508a9c923f18488b2aef300acbe2ecedbe4ff3e5ca2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\sed.exe
    Filesize

    96KB

    MD5

    2b657a67aebb84aea5632c53e61e23bf

    SHA1

    7d723cf82658da76bda85ae00bf20cb01b43edc8

    SHA256

    95a2e2cacfb63d095de385a98f1d5d4a21f0e7e8de485cbaf5b872434d43fb73

    SHA512

    16a68add6c2f6011c3c69dd3a3bf9496730c712e631c4992c19a83747020e8b560e3b93b08e95c536f245508a9c923f18488b2aef300acbe2ecedbe4ff3e5ca2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
    Filesize

    26KB

    MD5

    4f5f4878c3931a5906392b6124ae0fcb

    SHA1

    5119a8d63258583365e7c6e082ccb8879901fd32

    SHA256

    399ce9f214fd0af7a0ff40e4c28d979642396f602845f7c6d8cb3020aa9f791e

    SHA512

    ce7d7768f5a35c907af7de745b83f27dba0173f4f107e4c2823a6f1bbf304079fe73f39b8b5807dd421c61a6cabe26272c671e7a940f68752ebfd71638b79299

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\setpath.exe
    Filesize

    26KB

    MD5

    4f5f4878c3931a5906392b6124ae0fcb

    SHA1

    5119a8d63258583365e7c6e082ccb8879901fd32

    SHA256

    399ce9f214fd0af7a0ff40e4c28d979642396f602845f7c6d8cb3020aa9f791e

    SHA512

    ce7d7768f5a35c907af7de745b83f27dba0173f4f107e4c2823a6f1bbf304079fe73f39b8b5807dd421c61a6cabe26272c671e7a940f68752ebfd71638b79299

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\swxcacls.exe
    Filesize

    80KB

    MD5

    9cef63fde7a3a91a747ceb26d00fced3

    SHA1

    e32f3be159e7ed8ff722d7914e9bd76411f66f56

    SHA256

    8ddb40f126b0bac6095db82bd45bbe9b5d70b0a1e8542a82ab1df8031d776c9b

    SHA512

    5f1e0fd8a4f9131104f8cb58c91267026e126a4e832aee4e77ed2d4d8866e9b25406f02f17785c550661a58f9e11dbdd63ab784e9374d5cf7a42c5c7370763b0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\unhide.bat
    Filesize

    2KB

    MD5

    4427ca90cac3e5b4aff5e173ad2dd4f1

    SHA1

    9a33cc2a79676fb5f081cca6264aa4ad061058ea

    SHA256

    46efd6ebae7cbbb36b15b54cf409013172bf0fab6df92daefd9ea793d1fd30b2

    SHA512

    59bcc51f3a4d7826d1facf27ffa6207ede7bfae2a8a318514022af5bfd9f7063cfd730dec3bb0fe21dc67c6ab669b40afb42118ea4c9986b7e2534d7e0c4726c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\unhide.reg
    Filesize

    543B

    MD5

    fca6a5b2508b49f3363404a8e47d552a

    SHA1

    3ecd0d771baa100f4e1afa810bb3b1a27cd53aad

    SHA256

    609db8564ed67f25fb27d844c7ef2dfbc6bac0cf30eee127e2625e7583069804

    SHA512

    640571c86db7ef728bea66073ba35fe017d55edff124fe03deee41b1ff6e9f65bf4cad0fc465557e8ec0031e5eb4b414b8ebd1e3a1750622eadd841aefa1f9ef

    Download Submit

  • memory/2012-161-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/4240-154-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/4440-206-0x0000000000150000-0x0000000000153000-memory.dmp

    Filesize

    12KB

    Download

  • memory/4440-205-0x0000000000500000-0x00000000005D0000-memory.dmp

    Filesize

    832KB

    Download

  • memory/5068-147-0x0000000000400000-0x0000000000487000-memory.dmp

    Filesize

    540KB

    Download