Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 10:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86a04abc43302367987d735d1eec7516.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
86a04abc43302367987d735d1eec7516.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
86a04abc43302367987d735d1eec7516.exe
-
Size
220KB
-
MD5
86a04abc43302367987d735d1eec7516
-
SHA1
a356c4cbe79222dc47a056501451cde8c3076420
-
SHA256
7860d54f57f84f573dc8cc8b11bad483ebbe837bfef58d944ef46ac22d9be921
-
SHA512
e12f9f2889bd3df7f269938367af0eab47b40d48fa46203ca832586e305f4cee34e453ecea026c569d4e6264eb3c91a2ed408f26b1a832a69d130644985787ad
-
SSDEEP
3072:pexoX87v9mBhYlhgywlp2cQlftSymTlUMvCI2Zxo0:pexos+p2cQULlUzDx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wiepui.exe -
Executes dropped EXE 1 IoCs
pid Process 2796 wiepui.exe -
Loads dropped DLL 2 IoCs
pid Process 3068 86a04abc43302367987d735d1eec7516.exe 3068 86a04abc43302367987d735d1eec7516.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /o" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /I" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /W" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /z" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /X" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /x" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /F" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /G" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /v" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /T" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /d" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /P" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /u" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /V" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /n" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /E" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /D" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /U" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /N" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /p" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /K" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /i" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /H" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /y" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /c" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /s" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /w" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /m" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /R" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /Q" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /a" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /e" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /q" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /k" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /r" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /A" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /h" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /Z" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /J" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /g" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /M" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /Y" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /L" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /O" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /l" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /t" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /f" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /C" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /S" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /b" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /j" wiepui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiepui = "C:\\Users\\Admin\\wiepui.exe /B" wiepui.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe 2796 wiepui.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3068 86a04abc43302367987d735d1eec7516.exe 2796 wiepui.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2796 3068 86a04abc43302367987d735d1eec7516.exe 27 PID 3068 wrote to memory of 2796 3068 86a04abc43302367987d735d1eec7516.exe 27 PID 3068 wrote to memory of 2796 3068 86a04abc43302367987d735d1eec7516.exe 27 PID 3068 wrote to memory of 2796 3068 86a04abc43302367987d735d1eec7516.exe 27 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20 PID 2796 wrote to memory of 3068 2796 wiepui.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\86a04abc43302367987d735d1eec7516.exe"C:\Users\Admin\AppData\Local\Temp\86a04abc43302367987d735d1eec7516.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\wiepui.exe"C:\Users\Admin\wiepui.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD53272968955e865e220d3fe8ed2b3fa09
SHA1e0f01bfb3330afb199484466e51f06492bda7488
SHA256b5d613c68942227a3d397d39cd1b5f7f1ff9efe51b661bd62a0c22a2d9ac0511
SHA51218655559278a531142ba73d2b96d181cca816defdad34d1b4e8622fd23483d25db053e404e2a24ade772bdcc303800d9c4a300d37293918fbe05596357e326fe