Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
791f0783cb80857750f0b4517bea28e5.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
791f0783cb80857750f0b4517bea28e5.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
791f0783cb80857750f0b4517bea28e5.exe
-
Size
264KB
-
MD5
791f0783cb80857750f0b4517bea28e5
-
SHA1
ea1dd76fc739408f5217508f7d33fc7eb8f44471
-
SHA256
93a5d02ccd5a56c9d55ce74789b0e8164966386fa52ec6db261525e190bfeb92
-
SHA512
ba97e100d3f403b352bd3af0f581a29a69bf799441723c679da58ff069628e2c66abad5c009c13c31e12bb06774e05258449efe2ebe3f567c1f42e25a6be3453
-
SSDEEP
6144:qvXipyq9Ant8ppCZre+1HUNxFmIkIftoZqn/fIM27pHL7ejeT4EKdiK:qvXipyHt8pp4rL105P/27pHPeqe
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nbxiox.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 791f0783cb80857750f0b4517bea28e5.exe -
Executes dropped EXE 1 IoCs
pid Process 2180 nbxiox.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /P" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /n" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /d" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /J" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /o" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /T" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /j" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /v" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /S" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /E" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /z" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /C" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /w" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /H" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /m" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /M" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /t" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /G" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /l" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /s" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /D" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /K" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /k" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /Q" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /f" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /Z" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /u" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /c" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /A" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /b" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /r" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /X" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /y" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /B" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /I" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /U" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /q" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /O" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /g" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /V" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /p" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /R" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /a" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /x" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /e" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /F" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /Y" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /L" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /W" nbxiox.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nbxiox = "C:\\Users\\Admin\\nbxiox.exe /h" nbxiox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe 2180 nbxiox.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3416 791f0783cb80857750f0b4517bea28e5.exe 2180 nbxiox.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3416 wrote to memory of 2180 3416 791f0783cb80857750f0b4517bea28e5.exe 92 PID 3416 wrote to memory of 2180 3416 791f0783cb80857750f0b4517bea28e5.exe 92 PID 3416 wrote to memory of 2180 3416 791f0783cb80857750f0b4517bea28e5.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\791f0783cb80857750f0b4517bea28e5.exe"C:\Users\Admin\AppData\Local\Temp\791f0783cb80857750f0b4517bea28e5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\nbxiox.exe"C:\Users\Admin\nbxiox.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5c68f88e40d3570ac8dac8fb10fced320
SHA199595b6d106bdba83385909531c3043f42dc8820
SHA256bfa0fc198639e6c0ae1277d9885f9d7301a080f8eea5224274005079236b7cc2
SHA51290977a53d49de7484d598711070d139f72546f5b87f45191a3adc065c618ee7a58948bedf7dabcab4ae7e5c6335521222b32dd040ff2de3c6a6fbdc6a48ad861