Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2140b3395f2483e1df158c19b252ad17.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2140b3395f2483e1df158c19b252ad17.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2140b3395f2483e1df158c19b252ad17.exe
-
Size
252KB
-
MD5
2140b3395f2483e1df158c19b252ad17
-
SHA1
d12c788829e0b0c7d13e9eb87ee4866e24f697c7
-
SHA256
2f7c92580277a9430d2633a8a95aa11382ea07500a356934e3b76d4f5f6581c0
-
SHA512
6edd950cf6bd6cce037876da15012dc62a0f0158d431c767456a64a52a4ceabe4899d09b4e5a9152d5743a176a5733b83d61c7157d7c2b5057dcfd39f2ccdb88
-
SSDEEP
6144:WUxi2d1wlx34Z4mwD5eQpYgYV29G6McRgcVXOa/0udzUZZQMQCQQyA8lohYewTEN:Nic4eQpYgWMGYlViQQyBlohHwTE+70/t
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yoahe.exe -
Executes dropped EXE 1 IoCs
pid Process 1988 yoahe.exe -
Loads dropped DLL 2 IoCs
pid Process 828 2140b3395f2483e1df158c19b252ad17.exe 828 2140b3395f2483e1df158c19b252ad17.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /K" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /M" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /P" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /X" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /q" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /G" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /p" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /d" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /l" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /i" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /r" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /v" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /E" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /R" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /h" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /s" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /w" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /T" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /x" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /H" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /z" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /f" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /u" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /U" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /B" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /F" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /g" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /j" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /A" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /Y" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /o" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /S" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /Z" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /D" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /m" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /c" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /b" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /N" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /t" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /C" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /Q" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /a" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /J" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /n" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /V" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /W" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /L" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /I" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /e" yoahe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoahe = "C:\\Users\\Admin\\yoahe.exe /y" yoahe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe 1988 yoahe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 828 2140b3395f2483e1df158c19b252ad17.exe 1988 yoahe.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 828 wrote to memory of 1988 828 2140b3395f2483e1df158c19b252ad17.exe 28 PID 828 wrote to memory of 1988 828 2140b3395f2483e1df158c19b252ad17.exe 28 PID 828 wrote to memory of 1988 828 2140b3395f2483e1df158c19b252ad17.exe 28 PID 828 wrote to memory of 1988 828 2140b3395f2483e1df158c19b252ad17.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2140b3395f2483e1df158c19b252ad17.exe"C:\Users\Admin\AppData\Local\Temp\2140b3395f2483e1df158c19b252ad17.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\yoahe.exe"C:\Users\Admin\yoahe.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5767df58d3a93810fa27698d66efc11c8
SHA1fcce52c77dafdb2e6870dc47dd669810c3cae7cc
SHA25680d0949d50bad65d0db727e6efecc7bfd5dcf67c4d522e2a2e0c1c6e58c5b77e
SHA5129318504b9d7630f15228c76a45268f30196969d73d18ac9d5834d11c61247721391306ac07c92b933592778039c6e44d73a284dd3c77ab10b00cac3a94bb1a8b