Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
226700a4f98ed1364cd9521d12eda3f8.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
226700a4f98ed1364cd9521d12eda3f8.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
226700a4f98ed1364cd9521d12eda3f8.exe
-
Size
93KB
-
MD5
226700a4f98ed1364cd9521d12eda3f8
-
SHA1
c8c34f9638210d90bf626e567b8737a3e3a005d1
-
SHA256
928d1af074bd06c6db51b561a6abd4fd999682a41d221822144267ae40fabb8c
-
SHA512
87f7e0e566294f60a70eae0b9ad4457c4aadcdc707ceaa279b27420d9dfd19d2c95fa161e5995837c934dc87c91c7b05095b39a76b9a76797014302da50959be
-
SSDEEP
1536:BQAq6QGt8MnqugNE/o2bpqS7bQBaMd7/67kTs7+CJ:O6ruMna+/HZ8ISOkY7+C
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Beep.sys 226700a4f98ed1364cd9521d12eda3f8.exe File opened for modification C:\Windows\SysWOW64\drivers\Beep.sys 226700a4f98ed1364cd9521d12eda3f8.exe File opened for modification C:\Windows\SysWOW64\drivers\Beep.sys ShuiNiu.exe -
Deletes itself 1 IoCs
pid Process 588 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2732 ShuiNiu.exe -
Loads dropped DLL 4 IoCs
pid Process 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2732 ShuiNiu.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: ShuiNiu.exe File opened (read-only) \??\H: ShuiNiu.exe File opened (read-only) \??\E: 226700a4f98ed1364cd9521d12eda3f8.exe File opened (read-only) \??\H: 226700a4f98ed1364cd9521d12eda3f8.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ShuiNiu.exe 226700a4f98ed1364cd9521d12eda3f8.exe File created C:\Windows\SysWOW64\ShuiNiu.exe 226700a4f98ed1364cd9521d12eda3f8.exe File opened for modification C:\Windows\SysWOW64\ShuiNiu.exe ShuiNiu.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe 2452 226700a4f98ed1364cd9521d12eda3f8.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 472 Process not Found 472 Process not Found 472 Process not Found 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 2452 226700a4f98ed1364cd9521d12eda3f8.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2732 2452 226700a4f98ed1364cd9521d12eda3f8.exe 28 PID 2452 wrote to memory of 2732 2452 226700a4f98ed1364cd9521d12eda3f8.exe 28 PID 2452 wrote to memory of 2732 2452 226700a4f98ed1364cd9521d12eda3f8.exe 28 PID 2452 wrote to memory of 2732 2452 226700a4f98ed1364cd9521d12eda3f8.exe 28 PID 2732 wrote to memory of 2652 2732 ShuiNiu.exe 30 PID 2732 wrote to memory of 2652 2732 ShuiNiu.exe 30 PID 2732 wrote to memory of 2652 2732 ShuiNiu.exe 30 PID 2732 wrote to memory of 2652 2732 ShuiNiu.exe 30 PID 2452 wrote to memory of 588 2452 226700a4f98ed1364cd9521d12eda3f8.exe 32 PID 2452 wrote to memory of 588 2452 226700a4f98ed1364cd9521d12eda3f8.exe 32 PID 2452 wrote to memory of 588 2452 226700a4f98ed1364cd9521d12eda3f8.exe 32 PID 2452 wrote to memory of 588 2452 226700a4f98ed1364cd9521d12eda3f8.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\226700a4f98ed1364cd9521d12eda3f8.exe"C:\Users\Admin\AppData\Local\Temp\226700a4f98ed1364cd9521d12eda3f8.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\ShuiNiu.exeC:\Windows\system32\ShuiNiu.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\~rrxt!.BAt3⤵PID:2652
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\~fuwi!.BAt2⤵
- Deletes itself
PID:588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214B
MD5a28f089c87f24d58bb382821089310a8
SHA1cf7be9e56f05dd46b494943f08bd25b4ff7e31c8
SHA2560650dbf33a2ea548916ab6e2dad5cc64983f1c753432e71240216b10f7e40747
SHA512547b078d0b56e24bc6656af93db0565507215864b741336c8784b2a6452c8ef19142b11e7198b8fa00d928619288d4aa34432d047a56392ce8eec327b5b51def
-
Filesize
136B
MD556a21a18c8206ea381893b87c31019f6
SHA1dd83a9787b04b52ace46fcb7dd1d2adc63ba4067
SHA256e786fe29e359eb845e184a8f8a24dbfe9c9bc11e69559376192d058a4aeb0a39
SHA512296e9b44b5036b8f828f4233abb4b0d3e0bc0c69053b13c2fc952ee60e3adc582d52d7308123a0892ae5b8cb31bebb4f6b8eeee3bedf05855757caba8799a682
-
Filesize
3KB
MD5060908ce1e4a26a374f22b4aa6e8bab7
SHA14123d867dc8141d34c6d39ac4f68f9dc790ba997
SHA25661cdafa3c26771cdef626a2601df05b69d1c83cc2f56c37037cbf3a3edaee61c
SHA5120fd713ada2d345d16e3874f2a84aebe27c05706c80c084349335fb624fb5206a2dfe06fa5f85c93f136bbaa526993b7dcb02e8d555610a874c40df62c9a63431
-
Filesize
93KB
MD5226700a4f98ed1364cd9521d12eda3f8
SHA1c8c34f9638210d90bf626e567b8737a3e3a005d1
SHA256928d1af074bd06c6db51b561a6abd4fd999682a41d221822144267ae40fabb8c
SHA51287f7e0e566294f60a70eae0b9ad4457c4aadcdc707ceaa279b27420d9dfd19d2c95fa161e5995837c934dc87c91c7b05095b39a76b9a76797014302da50959be