Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 12:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
463ff215602d11ae3905412fad1323b9.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
463ff215602d11ae3905412fad1323b9.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
463ff215602d11ae3905412fad1323b9.exe
-
Size
96KB
-
MD5
463ff215602d11ae3905412fad1323b9
-
SHA1
ae4defb6fb71a2d0c1d1fe40a7c75c48c06fd11e
-
SHA256
7de81eccc93ea2936c4b205bda166a2af79d3b2996254fab292c2e342ef01858
-
SHA512
062856787997aabd17554ee8e3998162a5bba54a5c4b60a51f4c673eb03e22ddb267250eecc0e03e4736a2eff42595e6df5a4c61eb377ca31dccc6631b53497a
-
SSDEEP
1536:rMBSG9sgzWwmhLmncdkadGVScGYJXeiyCnO+TI4K4I4i404R4Z1VcvsJOpPpMm4t:2SG5W6cOadGRJuH7ut/Tdvd+hXV/vU3c
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vioko.exe -
Executes dropped EXE 1 IoCs
pid Process 2116 vioko.exe -
Loads dropped DLL 2 IoCs
pid Process 1180 463ff215602d11ae3905412fad1323b9.exe 1180 463ff215602d11ae3905412fad1323b9.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /b" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /X" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /y" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /o" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /Z" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /x" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /h" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /P" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /k" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /j" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /J" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /l" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /Y" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /d" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /w" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /T" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /p" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /g" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /s" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /O" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /I" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /K" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /N" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /i" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /M" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /F" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /n" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /C" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /Q" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /v" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /r" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /z" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /H" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /t" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /V" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /m" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /c" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /u" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /S" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /e" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /G" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /B" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /f" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /D" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /R" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /E" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /L" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /W" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /A" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /U" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /a" vioko.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\vioko = "C:\\Users\\Admin\\vioko.exe /q" vioko.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe 2116 vioko.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1180 463ff215602d11ae3905412fad1323b9.exe 2116 vioko.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1180 wrote to memory of 2116 1180 463ff215602d11ae3905412fad1323b9.exe 28 PID 1180 wrote to memory of 2116 1180 463ff215602d11ae3905412fad1323b9.exe 28 PID 1180 wrote to memory of 2116 1180 463ff215602d11ae3905412fad1323b9.exe 28 PID 1180 wrote to memory of 2116 1180 463ff215602d11ae3905412fad1323b9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\463ff215602d11ae3905412fad1323b9.exe"C:\Users\Admin\AppData\Local\Temp\463ff215602d11ae3905412fad1323b9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\vioko.exe"C:\Users\Admin\vioko.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5b3291f9dcf61b92ac7dc5980698e131d
SHA14399caba251b128f25daf4ae01fa2490c369cc80
SHA256ea7a81145d581af87b389d2ee95fb4d41fcaab698016af788a899f2016db6f1a
SHA512e64c17b969db57c98e3e229ea15658b3a1d5a469916d9e9184c62659fd1efcc34c2948c491064e4990dbcab0747f32fe429a243cb231a0d8dd934a3d3b012a74