Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 05:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f0d560ba461f552ea079c1e8e1e9597.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7f0d560ba461f552ea079c1e8e1e9597.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
7f0d560ba461f552ea079c1e8e1e9597.exe
-
Size
438KB
-
MD5
7f0d560ba461f552ea079c1e8e1e9597
-
SHA1
18d46ac48d1c4e6ba873f0b3b4f2049c8b3b77c4
-
SHA256
73c846a0f8625e95ae1ccb50fe41ada93bf891329beb9f21c2e920d77c014005
-
SHA512
c1817cbaa8bef2d4b9e9909082b13d295f6628f7b7d6dc1780860d321216cc729bc42b5dd86f2191526fc030ebd924e00158b8ceca724d7a36da45089ebe5e79
-
SSDEEP
6144:382p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbYBwNe:Tp4pNfz3ymJnJ8QCFkxCaQTOlOb
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 7f0d560ba461f552ea079c1e8e1e9597.exe -
Renames multiple (5580) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 7f0d560ba461f552ea079c1e8e1e9597.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 7f0d560ba461f552ea079c1e8e1e9597.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\W: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\B: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\S: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\T: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\M: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\R: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\G: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\H: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\J: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\P: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\Q: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\X: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\Z: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\E: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\I: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\N: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\O: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\V: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\Y: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\A: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\K: 7f0d560ba461f552ea079c1e8e1e9597.exe File opened (read-only) \??\L: 7f0d560ba461f552ea079c1e8e1e9597.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF 7f0d560ba461f552ea079c1e8e1e9597.exe File opened for modification C:\AUTORUN.INF 7f0d560ba461f552ea079c1e8e1e9597.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File opened for modification C:\Windows\SysWOW64\HelpMe.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Windows\SysWOW64\notepad.exe.exe 7f0d560ba461f552ea079c1e8e1e9597.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\UIAutomationProvider.resources.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-string-l1-1-0.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Forms.resources.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationCore.resources.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\FindRegister.3g2.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\PREVIEW.GIF.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.XlsIO.Base.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationCore.resources.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXEV.DLL.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\MSADDNDR.OLB.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\SPRING.INF.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolui.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Tasks.Extensions.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Parallel.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Word 2010 look.dotx.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.VisualBasic.Core.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\WindowsBase.resources.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.WPG.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\EVRGREEN.INF.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Expressions.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.exe 7f0d560ba461f552ea079c1e8e1e9597.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.exe 7f0d560ba461f552ea079c1e8e1e9597.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4292 7f0d560ba461f552ea079c1e8e1e9597.exe 4292 7f0d560ba461f552ea079c1e8e1e9597.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f0d560ba461f552ea079c1e8e1e9597.exe"C:\Users\Admin\AppData\Local\Temp\7f0d560ba461f552ea079c1e8e1e9597.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
438KB
MD53f15fbe539e5898b481b0a613272ea69
SHA168e3adb13349f675f36992d37b84202b438d816d
SHA25610a200e8ae0fcd5eab4b10e27c849decb5b7eeb3be49403f81ad9bd264c8fa96
SHA51267db84a1d9f80e17ec088b600b96e9bfff2918eec30268ffe69fc7c989621ceeb24c51e34432dc998c883f4d2c02267e4ce9190ed4493d42403309238a76dd6c
-
Filesize
1.2MB
MD5727e92e9a59cbaea35bc57ba15bbaa8d
SHA1a3ced10f5aa348b07702a47172d323e5c680e262
SHA256ea5cccf6cc646f0c84a6f51b1377f6bb4d78a65c314ac1eb0a1f2405b3fc91bd
SHA5122b7112cf4441fe02232116839bf270033d59888f70243bde520d28879b0c1834138a10e09797c1e280f9bb1f911ae6ebccf341090348734efcf3f84f57c7372d
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47