Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02e79a2037e12938390848af1f38cc75.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
02e79a2037e12938390848af1f38cc75.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
02e79a2037e12938390848af1f38cc75.exe
-
Size
176KB
-
MD5
02e79a2037e12938390848af1f38cc75
-
SHA1
3b81b7492a7c677c742067b8060e088bf14300c2
-
SHA256
1d03b2a5365f07b3f46db39b8e6d5d676894720c496c82b2a768da3b560df2d9
-
SHA512
4e144b826935e8a6bf3d55112ac1a9199e2371df3b997a57f77f9b157c62e87611a32c0bcbd880c8e77471a28541fbdb6dbbd1f20e116b035e0dca1d79e8d0ce
-
SSDEEP
3072:QC1IrKk+gj2HsfyKnvmb7/D26zjlBvWlzPpsPfIQ8sqLELTS55pMzcUK1eUyGei:/k+1Knvmb7/D26zjlBvWhPpsPfIQ8sq5
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 02e79a2037e12938390848af1f38cc75.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zouut.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 02e79a2037e12938390848af1f38cc75.exe -
Executes dropped EXE 1 IoCs
pid Process 5020 zouut.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /g" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /V" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /u" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /L" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /l" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /x" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /c" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /S" 02e79a2037e12938390848af1f38cc75.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /U" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /T" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /F" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /z" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /I" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /W" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /q" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /t" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /y" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /N" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /d" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /B" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /O" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /G" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /b" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /Y" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /Z" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /P" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /k" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /R" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /A" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /v" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /h" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /a" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /e" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /D" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /s" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /H" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /X" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /o" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /Q" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /J" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /M" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /i" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /S" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /f" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /n" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /E" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /j" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /m" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /r" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /C" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /w" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /p" zouut.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zouut = "C:\\Users\\Admin\\zouut.exe /K" zouut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4836 02e79a2037e12938390848af1f38cc75.exe 4836 02e79a2037e12938390848af1f38cc75.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe 5020 zouut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4836 02e79a2037e12938390848af1f38cc75.exe 5020 zouut.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4836 wrote to memory of 5020 4836 02e79a2037e12938390848af1f38cc75.exe 89 PID 4836 wrote to memory of 5020 4836 02e79a2037e12938390848af1f38cc75.exe 89 PID 4836 wrote to memory of 5020 4836 02e79a2037e12938390848af1f38cc75.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e79a2037e12938390848af1f38cc75.exe"C:\Users\Admin\AppData\Local\Temp\02e79a2037e12938390848af1f38cc75.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\zouut.exe"C:\Users\Admin\zouut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5c8e360b14e6f475ac19707c17df1ffdf
SHA19cf8d73db66bc963465ae0c29555d647af61e7a8
SHA25673b8c575b24f1c083342035e712bf7dc3b9e38ca7268ff11668b1c1e020a2f8a
SHA51273d0f8e9ca60be615b8e51aeff512f68ca4c708dad209fb9f28dcb8a6ac0dc5c64e910877d6f4ddcbfd7c1a18478c0a1d2d259fb6481f6a5d8d0f7617651e3e6
-
Filesize
65KB
MD552d58d9ad96702e417a4659296e766ec
SHA14b79d87bc217962d3cd699e18e3bd018c4d71861
SHA256c027af22924600c77578290663c67d82620cb5d756b155f996e84cdc924f6a89
SHA51249a2d0c8cac0ef9b49dbbbdf5951870e40f680be587e7b17f409e9b6a422bf91bdb34a4a7873bd708e254bc061d5f7c4eedbe0e376000970670084a65ed3940b
-
Filesize
176KB
MD5664505da7c3a155add05439fe96fae82
SHA112d6858001b1f4cde95e4ff9ddaebb4d95fb1cae
SHA256550022ef5ed7041f36f6096b649b96e806f586dfa90a5ef0d720045f86763a0d
SHA512b8657705436e1c711515b1fe2c13b38268ccece1355d873940aedb88e42c5297cf1503a37b4a780c27b03482ac1c1ad1326fe2bbc9ec6544f4dd8b068941de8c