Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:21
Behavioral task
behavioral1
Sample
0cc956e3f4befedd16d3f49ae9a269ed.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0cc956e3f4befedd16d3f49ae9a269ed.exe
Resource
win10v2004-20231215-en
General
-
Target
0cc956e3f4befedd16d3f49ae9a269ed.exe
-
Size
1.1MB
-
MD5
0cc956e3f4befedd16d3f49ae9a269ed
-
SHA1
a69268d42b52acee28051af2dc97397a1e42a980
-
SHA256
0a5e820027608f1aa3a807cd0ffa3d9d8c20ee0caebded53cfe95137fa9164b0
-
SHA512
21103d13232091f3a86984b32712e60b603aa63c9a2ac72bae6813f1be2ae1e2d7bdbfe6e83548ddff7941753f6281cb91a5410270834cb1f9e1c4b73bcee6e2
-
SSDEEP
12288:zMMpXKb0hNGh1kG0HWNAuCsltHlYzU+Wg7:zMMpXS0hN0V0HDIHyow
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 0cc956e3f4befedd16d3f49ae9a269ed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe -
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/files/0x000b000000012262-2.dat aspack_v212_v242 behavioral1/files/0x000b000000012262-4.dat aspack_v212_v242 behavioral1/files/0x0001000000000026-24.dat aspack_v212_v242 behavioral1/files/0x0033000000015491-39.dat aspack_v212_v242 -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe -
Executes dropped EXE 1 IoCs
pid Process 2704 HelpMe.exe -
Loads dropped DLL 2 IoCs
pid Process 2828 0cc956e3f4befedd16d3f49ae9a269ed.exe 2828 0cc956e3f4befedd16d3f49ae9a269ed.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\K: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\L: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\O: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\I: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\V: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\Y: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\M: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\S: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\E: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\Q: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\X: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\G: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\J: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\N: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\P: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\W: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\T: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\U: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\Z: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\A: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\H: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\R: 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\AUTORUN.INF 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened for modification F:\AUTORUN.INF 0cc956e3f4befedd16d3f49ae9a269ed.exe File opened for modification F:\AUTORUN.INF HelpMe.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe 0cc956e3f4befedd16d3f49ae9a269ed.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2704 2828 0cc956e3f4befedd16d3f49ae9a269ed.exe 27 PID 2828 wrote to memory of 2704 2828 0cc956e3f4befedd16d3f49ae9a269ed.exe 27 PID 2828 wrote to memory of 2704 2828 0cc956e3f4befedd16d3f49ae9a269ed.exe 27 PID 2828 wrote to memory of 2704 2828 0cc956e3f4befedd16d3f49ae9a269ed.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cc956e3f4befedd16d3f49ae9a269ed.exe"C:\Users\Admin\AppData\Local\Temp\0cc956e3f4befedd16d3f49ae9a269ed.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5240ed91d65decd95612d589dc6d7e37f
SHA10921665ae6e2c3c5a24ce87e93a0a15b93887372
SHA2568f2d1ea21d1597be892668d2e9670bfae5eff737beaeb08b00c412f46907c1a7
SHA51251978691d9dc7e0b745219c8bfed99dcef8bd55a795c6342687263fdb53b23237fcf9a90f1a115b3527f59ca03dcc9d647ab65a817f473977a720a770d896d7a
-
Filesize
1KB
MD5aeb60fb8963ee558ed919dba50ab733a
SHA1e338145a890235c1eb835c1f6375bb24e234e5ce
SHA256ff3714a3fad4eebdf6791cde68d81cfdd97461bdf58b7ddc099bc6cf059112a1
SHA51236ef1af707f3911c45f08dae7b7d77787b21561ac0e1e4a3e7fe8df87b9077cf0c3a11e8b33eaf4ab2ffa2daab5deb1884b7be5b0e15ca46f8b355063ccec53a
-
Filesize
954B
MD560b788561c54cb2e5603ea8887a7ba34
SHA108aaea001476907cc6bdb160dba1e3ea157b5ca2
SHA256b992b9a0be154c122de7948d7575570d164e603dc630be353c5d6d8c8b11be0b
SHA5126175a1a53bb2c1c70a096a74a40a02fa907fcbe425c3a76d1b579e2883c39360ba6c0b2e4b6a819dcd2fcb64659ec0a0289edb2eeb7915fcb0c77d5a0e6fdacf
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
1.1MB
MD50cc956e3f4befedd16d3f49ae9a269ed
SHA1a69268d42b52acee28051af2dc97397a1e42a980
SHA2560a5e820027608f1aa3a807cd0ffa3d9d8c20ee0caebded53cfe95137fa9164b0
SHA51221103d13232091f3a86984b32712e60b603aa63c9a2ac72bae6813f1be2ae1e2d7bdbfe6e83548ddff7941753f6281cb91a5410270834cb1f9e1c4b73bcee6e2
-
Filesize
1.1MB
MD57930f19c44280f3b5228bff5bb968ce5
SHA1a4e04359fb5c6e5f59f6881109f58ea6c32ed5d4
SHA2564cd5b7e79c9958a711b425aeb9e37886c7c9f56bb5e4b708d3b480cd071f39be
SHA5122347f8539d59119cd80eae40993110c56d54cd51612dec3918bd587720fbf1e8a22903db7afe0711fe4dfa3db7f697277c846c778bccf3a4f841a46e4d612656
-
Filesize
885KB
MD58bd7754b0d8e891647c879e3f0c01c0a
SHA17b503e9ab640e21b0c6fa7401b80db09fc2fb4f0
SHA256f216cceea18b8674b9742dab6f586282c551ed57ab7756530394e3ebf1973557
SHA512633eabe58a264de833190f322d5ffb27656194932648f8eb22b0b687f242b919f2f000d44a94412ac434ebfe93161aa0d7cb21b4549e4ef3fe905add99b5232c