Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
206s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46e2a44ad003b73fe87e8273949b3ac2.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
46e2a44ad003b73fe87e8273949b3ac2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
46e2a44ad003b73fe87e8273949b3ac2.exe
-
Size
248KB
-
MD5
46e2a44ad003b73fe87e8273949b3ac2
-
SHA1
9d6fe19cce46e6cf9c3acf1dddfc1147d50a1755
-
SHA256
34e723d04cad4e6566454837ca5e950e32166a5ba8f06aca5e38efac6aca494e
-
SHA512
8db160607f91ebbce63ec675e467a2cf68ddce901f0c7c75b9c70d119bd298d12738423f44f9ae6b77c99dd8979ff0f885b0b3df97c524cc57cf5c9166135efc
-
SSDEEP
3072:+R4z/dJvRDFD1yPBYEmaHtGG2gqZ+/9A+JRjKY5Md41gfy27:PJh1yPptGG2gqZ+FfKqDsX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 46e2a44ad003b73fe87e8273949b3ac2.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sipop.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 46e2a44ad003b73fe87e8273949b3ac2.exe -
Executes dropped EXE 1 IoCs
pid Process 2328 sipop.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /H" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /S" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /X" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /z" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /Z" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /c" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /N" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /r" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /v" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /l" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /J" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /W" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /U" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /F" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /s" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /C" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /d" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /Y" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /p" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /b" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /I" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /B" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /o" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /L" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /A" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /n" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /t" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /u" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /h" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /g" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /D" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /O" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /T" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /f" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /R" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /y" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /A" 46e2a44ad003b73fe87e8273949b3ac2.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /K" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /w" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /q" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /m" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /Q" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /i" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /M" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /j" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /G" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /E" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /k" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /P" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /V" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /a" sipop.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sipop = "C:\\Users\\Admin\\sipop.exe /x" sipop.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 46e2a44ad003b73fe87e8273949b3ac2.exe 4864 46e2a44ad003b73fe87e8273949b3ac2.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe 2328 sipop.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4864 46e2a44ad003b73fe87e8273949b3ac2.exe 2328 sipop.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4864 wrote to memory of 2328 4864 46e2a44ad003b73fe87e8273949b3ac2.exe 92 PID 4864 wrote to memory of 2328 4864 46e2a44ad003b73fe87e8273949b3ac2.exe 92 PID 4864 wrote to memory of 2328 4864 46e2a44ad003b73fe87e8273949b3ac2.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\46e2a44ad003b73fe87e8273949b3ac2.exe"C:\Users\Admin\AppData\Local\Temp\46e2a44ad003b73fe87e8273949b3ac2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\sipop.exe"C:\Users\Admin\sipop.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5fd79424988d07045f7158726421daa33
SHA1eecc1f73d98a7168d9f9bf8acef69287ac283c85
SHA256c49530ed99754b65dca68ea012f0ab6b1d1608ef208fa2af96984663ec672854
SHA512e1826286c6ddc6701c1c81ef6e2a9cc305401c35401571b6f4f3737e25ca54644106d9abb363386226653ca02d1c85d9ad7a80184c74957fd152861cfaa162bf