Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 10:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08d2d8832dc8583f00c8843f0d78744b.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
08d2d8832dc8583f00c8843f0d78744b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
08d2d8832dc8583f00c8843f0d78744b.exe
-
Size
108KB
-
MD5
08d2d8832dc8583f00c8843f0d78744b
-
SHA1
478dffff321e3c443bc9be9663ebaa795335d8a6
-
SHA256
61ca90378ef6d2dc9b3a512838ff834d6d4114e2d0d34db365b43cfb23d2c3df
-
SHA512
8bf96235d1e6100917d4f2a47248976522f26134bdbf5173e55af1efc090a6c697ab935d0881fcc06d6265d39b46381ddc8c8c7fe8ba8db3ca976f18cbe158a0
-
SSDEEP
1536:2j9Q77LvgM/AQmSNFONMlszAjUkxtAyCNTXrtG1NcJ:+s3gf1ABt+NTRPJ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiaguib.exe -
Executes dropped EXE 1 IoCs
pid Process 3000 xiaguib.exe -
Loads dropped DLL 2 IoCs
pid Process 2216 08d2d8832dc8583f00c8843f0d78744b.exe 2216 08d2d8832dc8583f00c8843f0d78744b.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /c" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /Z" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /a" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /v" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /p" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /P" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /y" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /l" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /H" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /N" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /I" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /J" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /d" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /R" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /E" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /C" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /h" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /U" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /i" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /t" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /z" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /Q" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /M" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /x" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /X" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /S" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /s" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /B" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /k" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /D" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /F" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /u" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /V" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /O" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /W" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /r" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /m" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /A" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /b" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /f" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /L" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /g" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /T" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /o" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /n" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /w" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /K" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /e" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /j" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /Y" xiaguib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\xiaguib = "C:\\Users\\Admin\\xiaguib.exe /q" xiaguib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe 3000 xiaguib.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2216 08d2d8832dc8583f00c8843f0d78744b.exe 3000 xiaguib.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 3000 2216 08d2d8832dc8583f00c8843f0d78744b.exe 28 PID 2216 wrote to memory of 3000 2216 08d2d8832dc8583f00c8843f0d78744b.exe 28 PID 2216 wrote to memory of 3000 2216 08d2d8832dc8583f00c8843f0d78744b.exe 28 PID 2216 wrote to memory of 3000 2216 08d2d8832dc8583f00c8843f0d78744b.exe 28 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1 PID 3000 wrote to memory of 2216 3000 xiaguib.exe 1
Processes
-
C:\Users\Admin\AppData\Local\Temp\08d2d8832dc8583f00c8843f0d78744b.exe"C:\Users\Admin\AppData\Local\Temp\08d2d8832dc8583f00c8843f0d78744b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\xiaguib.exe"C:\Users\Admin\xiaguib.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5497aaa384c87566843b2cff459dc6446
SHA12062ebf38d799f4dc994b396ad81d6c3bd767739
SHA256d3ad0d319005907d43491070673106231c0c5c075b6d6207408846eb3b1335f4
SHA51207f8c5967c3d7ab0301697411197664bf35888d6cbf1ef6f5af35cb9454271c35e10c7f3bd7c723a2bd9fdc5b72e7e072a2468ffc7e959a2b54ff36c9b00887b