Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76c558e35dabf3bb233dc75b8a57a160_JC.exe
Resource
win7-20230831-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
76c558e35dabf3bb233dc75b8a57a160_JC.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
76c558e35dabf3bb233dc75b8a57a160_JC.exe
-
Size
56KB
-
MD5
76c558e35dabf3bb233dc75b8a57a160
-
SHA1
cb5c20ac9a202f93908134d21bcb4c8e193b1743
-
SHA256
189bd2124bf6745f8083c6f6820feef1044e0190a0415ff1c467f427b4d8593c
-
SHA512
23fb8486053064d4c8d954fdaaf9249164c3dea558fe2bd37433f4a00589066370a77a1ee19c0ae631239d93d24f36797ca1df82d54981e6a6ad0df7684b61ff
-
SSDEEP
768:xgMNEhm6g4/yZnquYIv+6wH9H7MfygXaDMFQXD7e7DQ:xgMamW/luj6NNDsQXD7i8
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buebud.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation 76c558e35dabf3bb233dc75b8a57a160_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 2548 buebud.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buebud = "C:\\Users\\Admin\\buebud.exe" buebud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe 2548 buebud.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5000 76c558e35dabf3bb233dc75b8a57a160_JC.exe 2548 buebud.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5000 wrote to memory of 2548 5000 76c558e35dabf3bb233dc75b8a57a160_JC.exe 89 PID 5000 wrote to memory of 2548 5000 76c558e35dabf3bb233dc75b8a57a160_JC.exe 89 PID 5000 wrote to memory of 2548 5000 76c558e35dabf3bb233dc75b8a57a160_JC.exe 89 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80 PID 2548 wrote to memory of 5000 2548 buebud.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\76c558e35dabf3bb233dc75b8a57a160_JC.exe"C:\Users\Admin\AppData\Local\Temp\76c558e35dabf3bb233dc75b8a57a160_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\buebud.exe"C:\Users\Admin\buebud.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5ccf6fc85e6c11be0818ffcb8f8df352a
SHA1dbf6d04286c5bc28bc424a291ea13ac2a422ecec
SHA2566a065212d581cd0df3b3d8bc36fee88177aee87fbc1fd70327de0becda46c00c
SHA5126fa09750991c58a801997ae80e05ee922ab329a5b4c6b69f49fabcb9ca906cbe2260e8499f18ef9e5efad3763530162d073b8314aa9edcf02d3324a6c5d4ddf3
-
Filesize
56KB
MD5ccf6fc85e6c11be0818ffcb8f8df352a
SHA1dbf6d04286c5bc28bc424a291ea13ac2a422ecec
SHA2566a065212d581cd0df3b3d8bc36fee88177aee87fbc1fd70327de0becda46c00c
SHA5126fa09750991c58a801997ae80e05ee922ab329a5b4c6b69f49fabcb9ca906cbe2260e8499f18ef9e5efad3763530162d073b8314aa9edcf02d3324a6c5d4ddf3
-
Filesize
56KB
MD5ccf6fc85e6c11be0818ffcb8f8df352a
SHA1dbf6d04286c5bc28bc424a291ea13ac2a422ecec
SHA2566a065212d581cd0df3b3d8bc36fee88177aee87fbc1fd70327de0becda46c00c
SHA5126fa09750991c58a801997ae80e05ee922ab329a5b4c6b69f49fabcb9ca906cbe2260e8499f18ef9e5efad3763530162d073b8314aa9edcf02d3324a6c5d4ddf3