Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b5139b7679e2e3fe6c7787778ed64e7.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7b5139b7679e2e3fe6c7787778ed64e7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7b5139b7679e2e3fe6c7787778ed64e7.exe
-
Size
240KB
-
MD5
7b5139b7679e2e3fe6c7787778ed64e7
-
SHA1
2994e2093e8239730cb7033e636f02987d9bba71
-
SHA256
14ca1cd38d51f377c036b6617d1ad3321db7cebf5ac5ac487561974e003da129
-
SHA512
8d86ca47783433a33091cf64709e86225cee41836bf9831ba63ea1354eb15440e5d0d1ad89262692746edb64534e9aa16adeaf753f2db3c096adcb9dc5cd59f6
-
SSDEEP
6144:jUI3dwqsNweTAB0EqxF6snji81RUinKchht8S3H:DdQ5JDbX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7b5139b7679e2e3fe6c7787778ed64e7.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" buumeex.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 buumeex.exe -
Loads dropped DLL 2 IoCs
pid Process 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /d" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /m" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /q" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /c" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /f" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /n" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /b" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /j" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /p" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /a" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /s" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /z" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /b" 7b5139b7679e2e3fe6c7787778ed64e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /h" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /w" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /i" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /g" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /l" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /y" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /e" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /r" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /u" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /o" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /t" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /x" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /v" buumeex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\buumeex = "C:\\Users\\Admin\\buumeex.exe /k" buumeex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe 2788 buumeex.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe 2788 buumeex.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2788 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe 28 PID 2996 wrote to memory of 2788 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe 28 PID 2996 wrote to memory of 2788 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe 28 PID 2996 wrote to memory of 2788 2996 7b5139b7679e2e3fe6c7787778ed64e7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b5139b7679e2e3fe6c7787778ed64e7.exe"C:\Users\Admin\AppData\Local\Temp\7b5139b7679e2e3fe6c7787778ed64e7.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\buumeex.exe"C:\Users\Admin\buumeex.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5e8de56a43bfc3ed4a622cd3eea508974
SHA1368dd1e41bd77f4dc255204344e096c410d8944d
SHA256396c8f3fe126b84f43df478cc57bc4f9ce9dc7bfeddb4e9e3b14e9f8deed4941
SHA512a0f8288be431123065d4076ac6601be406e03a462eb02c618942861e2cdc7054f5162ea5ea168f7b42a8c58d5249b7aac784cf8085f610200feafde3e9345ce1