Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2024, 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79819a0602ff2a66857915e284d87a32.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
79819a0602ff2a66857915e284d87a32.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
79819a0602ff2a66857915e284d87a32.exe
-
Size
208KB
-
MD5
79819a0602ff2a66857915e284d87a32
-
SHA1
c60d79059fdb95b0ea1c37a5805b1b170d5888ba
-
SHA256
487f36ad4da4416cecb13c07b1298f1e23e71e0409575e4a56ac0092a816667d
-
SHA512
0214985fef4278069ca68d1b087b68fe319ce9da57d9c748bfd96ecf4c29283f462035a1d2ad700b46880b01bb8b7fdbcf3ff48198b620800144a0533c0ab761
-
SSDEEP
3072:nDMM1KVLDp979aAqvxpDWDhQx9AhHp8NeqxEN1yy8p+uxs/Y:n5KVboA8pDqQx9AhJSRxiJ8jK/Y
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 79819a0602ff2a66857915e284d87a32.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meaita.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 79819a0602ff2a66857915e284d87a32.exe -
Executes dropped EXE 1 IoCs
pid Process 3108 meaita.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /w" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /A" 79819a0602ff2a66857915e284d87a32.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /A" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /z" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /B" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /G" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /K" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /S" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /E" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /v" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /X" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /d" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /e" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /p" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /n" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /c" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /i" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /h" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /R" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /Q" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /o" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /l" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /W" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /j" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /P" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /u" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /a" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /m" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /Z" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /J" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /M" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /T" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /q" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /I" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /y" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /D" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /Y" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /f" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /r" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /F" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /O" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /g" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /k" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /b" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /L" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /C" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /V" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /N" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /t" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /x" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /s" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /U" meaita.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\meaita = "C:\\Users\\Admin\\meaita.exe /H" meaita.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4872 79819a0602ff2a66857915e284d87a32.exe 4872 79819a0602ff2a66857915e284d87a32.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe 3108 meaita.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4872 79819a0602ff2a66857915e284d87a32.exe 3108 meaita.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4872 wrote to memory of 3108 4872 79819a0602ff2a66857915e284d87a32.exe 94 PID 4872 wrote to memory of 3108 4872 79819a0602ff2a66857915e284d87a32.exe 94 PID 4872 wrote to memory of 3108 4872 79819a0602ff2a66857915e284d87a32.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\79819a0602ff2a66857915e284d87a32.exe"C:\Users\Admin\AppData\Local\Temp\79819a0602ff2a66857915e284d87a32.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\meaita.exe"C:\Users\Admin\meaita.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD559b56492dc3035743df167933f515e30
SHA1b835ed1a9673ab459fbeb07128e1bfce28ed6348
SHA256a9c12d2f7339d7c035a143cc4de7cb0b7493045311b4a507cdb6dc14a3323c17
SHA512efce0f466076d2305aafb3b1151530805ba3eda46ab9d880919f7fcbc7e067b5086b54ccbb2c20390bfa39395291e27147cf134dd8fa97fc1ca3ce1a167f1c6e