Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2570e921ed79b43c5f6b5973ccd3af47.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2570e921ed79b43c5f6b5973ccd3af47.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2570e921ed79b43c5f6b5973ccd3af47.exe
-
Size
256KB
-
MD5
2570e921ed79b43c5f6b5973ccd3af47
-
SHA1
8b55cda00a986c6d78a9359221a2bea973cab788
-
SHA256
c6dc339447800099a816eb502a55a3706596f8d2ddffa0161f57b48ff4f68e72
-
SHA512
4677e7d148dbcf91ded92e0f9ebed1add3d47a0c37e5d06fa00919b8cd3d7b2d93119bd6b7d70e9059e6b5c9e97f7718e5fbd29a144e14b98d734d4bc7189f30
-
SSDEEP
1536:j+ogF/gFu0e9ebe9eNevdmoMel6efh4JPEhXnoQw6AcbaCEk:KogF/gFuP6efh4JPEhXnoQw6AcbaCb
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kauemad.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 2570e921ed79b43c5f6b5973ccd3af47.exe -
Executes dropped EXE 1 IoCs
pid Process 2680 kauemad.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /l" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /g" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /a" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /s" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /R" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /U" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /c" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /A" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /n" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /m" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /G" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /P" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /h" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /I" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /u" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /Z" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /B" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /o" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /S" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /V" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /i" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /N" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /K" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /b" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /H" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /y" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /j" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /L" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /e" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /F" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /Q" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /d" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /C" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /k" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /r" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /x" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /z" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /t" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /E" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /w" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /T" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /X" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /O" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /v" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /D" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /M" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /J" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /f" kauemad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kauemad = "C:\\Users\\Admin\\kauemad.exe /p" kauemad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe 2680 kauemad.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 888 2570e921ed79b43c5f6b5973ccd3af47.exe 2680 kauemad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 888 wrote to memory of 2680 888 2570e921ed79b43c5f6b5973ccd3af47.exe 90 PID 888 wrote to memory of 2680 888 2570e921ed79b43c5f6b5973ccd3af47.exe 90 PID 888 wrote to memory of 2680 888 2570e921ed79b43c5f6b5973ccd3af47.exe 90 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16 PID 2680 wrote to memory of 888 2680 kauemad.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\2570e921ed79b43c5f6b5973ccd3af47.exe"C:\Users\Admin\AppData\Local\Temp\2570e921ed79b43c5f6b5973ccd3af47.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\kauemad.exe"C:\Users\Admin\kauemad.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD57d3ce34330158f5fb580db38ad5505fc
SHA15d15cd99a925852c90f2cf495bf7b919e15a96fa
SHA256db309d450c0b321c91645be32f6044282142c2df8e345ed9421cacc653810fcf
SHA512aa8f926dfdf0385f3658046455da8192ea3117594189bcbc4238a4eef99513c25e3fc79c6e063661de5ece5db2ce8217dcd801bf7fd52fb8db3c9f093841c301
-
Filesize
215KB
MD5d02ded691321dd60e828371954f73661
SHA18aafe786293b4938d0122441e8dbbb02e2744b7a
SHA25606532771811d4558677eefe4e848d9c94b8cf108796b738387e9e5059f0b89d9
SHA512b6727c875773691542b4ed7dd5d8d81c924727f8f37ba324f8210993e3c73cf7dd1c765fb2c6f26758351bd1f2c603595d643f79a4876304c79dd69f52f613e8
-
Filesize
190KB
MD5c7f2a270750de405140ea64673d8239a
SHA1aa75a98ecc877c46b7c3e3151eea2fb533af4785
SHA256da8051c7fadfe743fd40feccb887d6790b9467d421d9e3318be8c9ce20fef3fd
SHA512d4e7542f6f863d0e97559330e544780a1043adabd5d1d4c8d167706c76b25beafa4c1098e21c1af3a3df13b63f40b77185755fe4f0e821adb14ad45470a0557d