Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4979d365f1279a84525cfaae1025b300.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4979d365f1279a84525cfaae1025b300.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4979d365f1279a84525cfaae1025b300.exe
-
Size
96KB
-
MD5
4979d365f1279a84525cfaae1025b300
-
SHA1
a05cabf1e2c23fab056bd4d183704f1d3f8b3390
-
SHA256
6e43743039352edff38845ad63e4e60bf9ea055cecda04d4dda5179edf6f8328
-
SHA512
c2dd9f41397064f0cb97b93551f5d0ed00a88cb66dd37e5f80ca831fa954de6ec65faa925930bd004af54f7c25cb58d5382faec38008f665cbe7921d86b6dc9a
-
SSDEEP
1536:2GBTozhgzWwmhLmncdkadGVScGYJXeiyCnO+TI4K4I4i404R4Z1VcvsJOpPpMm4S:dEzaW6cOadGRJuH7ut/Tdvd+hXV/vU3n
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" keiij.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 4979d365f1279a84525cfaae1025b300.exe -
Executes dropped EXE 1 IoCs
pid Process 3740 keiij.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /D" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /E" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /g" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /W" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /G" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /L" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /p" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /P" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /q" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /H" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /X" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /K" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /Y" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /f" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /a" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /m" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /R" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /U" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /A" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /J" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /V" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /d" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /M" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /n" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /b" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /t" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /N" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /w" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /F" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /i" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /h" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /u" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /T" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /o" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /I" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /e" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /C" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /Z" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /r" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /O" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /S" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /v" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /y" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /k" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /z" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /Q" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /s" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /j" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /B" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /c" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /x" keiij.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keiij = "C:\\Users\\Admin\\keiij.exe /l" keiij.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe 3740 keiij.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1016 4979d365f1279a84525cfaae1025b300.exe 3740 keiij.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1016 wrote to memory of 3740 1016 4979d365f1279a84525cfaae1025b300.exe 92 PID 1016 wrote to memory of 3740 1016 4979d365f1279a84525cfaae1025b300.exe 92 PID 1016 wrote to memory of 3740 1016 4979d365f1279a84525cfaae1025b300.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4979d365f1279a84525cfaae1025b300.exe"C:\Users\Admin\AppData\Local\Temp\4979d365f1279a84525cfaae1025b300.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\keiij.exe"C:\Users\Admin\keiij.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5b082eb9cc28bd147234e0586d6ddfdfb
SHA14da3ff3526fd879249a13070d6939267f8750a53
SHA256a723c2075898639b9262a2bb9b159f89094b22d9d72c15932cdade519bf0d749
SHA51225b0cbed03db2c26adb07683abe5fdbd66637eeb317b51c55ff61db496db461659b31a40329aafcec10ab34a1aafc863e25817cadd27ba152f72582b6ccfb4a5