Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
226700a4f98ed1364cd9521d12eda3f8.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
226700a4f98ed1364cd9521d12eda3f8.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
226700a4f98ed1364cd9521d12eda3f8.exe
-
Size
93KB
-
MD5
226700a4f98ed1364cd9521d12eda3f8
-
SHA1
c8c34f9638210d90bf626e567b8737a3e3a005d1
-
SHA256
928d1af074bd06c6db51b561a6abd4fd999682a41d221822144267ae40fabb8c
-
SHA512
87f7e0e566294f60a70eae0b9ad4457c4aadcdc707ceaa279b27420d9dfd19d2c95fa161e5995837c934dc87c91c7b05095b39a76b9a76797014302da50959be
-
SSDEEP
1536:BQAq6QGt8MnqugNE/o2bpqS7bQBaMd7/67kTs7+CJ:O6ruMna+/HZ8ISOkY7+C
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\Beep.sys 226700a4f98ed1364cd9521d12eda3f8.exe File opened for modification C:\Windows\SysWOW64\drivers\Beep.sys 226700a4f98ed1364cd9521d12eda3f8.exe File opened for modification C:\Windows\SysWOW64\drivers\Beep.sys ShuiNiu.exe -
Executes dropped EXE 1 IoCs
pid Process 2208 ShuiNiu.exe -
Loads dropped DLL 2 IoCs
pid Process 1148 226700a4f98ed1364cd9521d12eda3f8.exe 2208 ShuiNiu.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 226700a4f98ed1364cd9521d12eda3f8.exe File opened (read-only) \??\H: 226700a4f98ed1364cd9521d12eda3f8.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ShuiNiu.exe 226700a4f98ed1364cd9521d12eda3f8.exe File created C:\Windows\SysWOW64\ShuiNiu.exe 226700a4f98ed1364cd9521d12eda3f8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe 1148 226700a4f98ed1364cd9521d12eda3f8.exe -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe Token: SeDebugPrivilege 1148 226700a4f98ed1364cd9521d12eda3f8.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1148 wrote to memory of 2208 1148 226700a4f98ed1364cd9521d12eda3f8.exe 34 PID 1148 wrote to memory of 2208 1148 226700a4f98ed1364cd9521d12eda3f8.exe 34 PID 1148 wrote to memory of 2208 1148 226700a4f98ed1364cd9521d12eda3f8.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\226700a4f98ed1364cd9521d12eda3f8.exe"C:\Users\Admin\AppData\Local\Temp\226700a4f98ed1364cd9521d12eda3f8.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\ShuiNiu.exeC:\Windows\system32\ShuiNiu.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~berm!.BAt3⤵PID:3788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~gfqp!.BAt2⤵PID:1740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5060908ce1e4a26a374f22b4aa6e8bab7
SHA14123d867dc8141d34c6d39ac4f68f9dc790ba997
SHA25661cdafa3c26771cdef626a2601df05b69d1c83cc2f56c37037cbf3a3edaee61c
SHA5120fd713ada2d345d16e3874f2a84aebe27c05706c80c084349335fb624fb5206a2dfe06fa5f85c93f136bbaa526993b7dcb02e8d555610a874c40df62c9a63431
-
Filesize
136B
MD556a21a18c8206ea381893b87c31019f6
SHA1dd83a9787b04b52ace46fcb7dd1d2adc63ba4067
SHA256e786fe29e359eb845e184a8f8a24dbfe9c9bc11e69559376192d058a4aeb0a39
SHA512296e9b44b5036b8f828f4233abb4b0d3e0bc0c69053b13c2fc952ee60e3adc582d52d7308123a0892ae5b8cb31bebb4f6b8eeee3bedf05855757caba8799a682
-
Filesize
214B
MD5a28f089c87f24d58bb382821089310a8
SHA1cf7be9e56f05dd46b494943f08bd25b4ff7e31c8
SHA2560650dbf33a2ea548916ab6e2dad5cc64983f1c753432e71240216b10f7e40747
SHA512547b078d0b56e24bc6656af93db0565507215864b741336c8784b2a6452c8ef19142b11e7198b8fa00d928619288d4aa34432d047a56392ce8eec327b5b51def
-
Filesize
93KB
MD5226700a4f98ed1364cd9521d12eda3f8
SHA1c8c34f9638210d90bf626e567b8737a3e3a005d1
SHA256928d1af074bd06c6db51b561a6abd4fd999682a41d221822144267ae40fabb8c
SHA51287f7e0e566294f60a70eae0b9ad4457c4aadcdc707ceaa279b27420d9dfd19d2c95fa161e5995837c934dc87c91c7b05095b39a76b9a76797014302da50959be
-
Filesize
2KB
MD5ddae8f1d33bb3a1857da5cc6c347e15d
SHA14ef32c816008750edad094107170904d9db4c4b0
SHA2560cd3d48bf0614d56dcdb4b75d9f6144e09318d40cc5096d21e9df18fb1c7c5df
SHA512aee28cf812d3bd9bca9b393ceb4581fd59119776600e6c88e1949847a218483f3fcdbd441aad80e7415f90ecb65a56be4e0628a58660c37b3c0014872cffd99a