Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/10/2023, 07:12 UTC

231031-h1xr9shb9w 6

31/10/2023, 07:09 UTC

231031-hy68xsbc69 6

31/10/2023, 07:01 UTC

231031-htdqtabc49 6

Analysis

  • max time kernel
    173s
  • max time network
    170s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31/10/2023, 07:12 UTC

General

  • Target

    HideUL/HideUL.exe

  • Size

    779KB

  • MD5

    59e6919b61bcef4225d571e10fb13ef2

  • SHA1

    c864cb1e389c51bdea6cecfed47162e6a03f1e22

  • SHA256

    65ceb24e66bdac7453863bf268316bf6b6b17070ae1100713027c0be398e61f6

  • SHA512

    c904007bd0989c6be41ce1afbbf05fa72d4f81a8b5a4e81e0fda11030e772d6a33c21fad0fe4e1faf97ec0611427a8c7aa6366d5920714e835ba80444f76d89c

  • SSDEEP

    12288:daWzgMg7v3qnCiMErQohh0F4TCJ8lnyJQY4ZNGdiXJpp05iwQK:8aHMv6C4rjXnyJQRZYiA5kK

Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs regedit.exe 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HideUL\HideUL.exe
    "C:\Users\Admin\AppData\Local\Temp\HideUL\HideUL.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:4252
  • C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    1⤵
    • Runs regedit.exe
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    PID:4896
  • C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    1⤵
    • Runs regedit.exe
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    PID:4504
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:2356

    Network

    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.173.189.20.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      1.173.189.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      1.173.189.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4252-7-0x0000000008190000-0x0000000008191000-memory.dmp

      Filesize

      4KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.