Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 15:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8cbd96172613aa968f3c3f77ca8caf5d.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8cbd96172613aa968f3c3f77ca8caf5d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
8cbd96172613aa968f3c3f77ca8caf5d.exe
-
Size
92KB
-
MD5
8cbd96172613aa968f3c3f77ca8caf5d
-
SHA1
9b66b51211b709e227e236846e2ed5d8a575aa57
-
SHA256
51d44f65335a6ae50c85f955d85331f6fea02fbe8808743d5e3d6446ea0236a6
-
SHA512
50bf4e299c0cf62166db9d98aa2b39358d7d7515a43997798f30087dfcd2aad7c488488bf144c9e96fb6648c32940dc45dc82159cfca4ad3eea5396c5b0ad67c
-
SSDEEP
1536:OEonYIFv/8BJCMF/J2ApPN1osNTgTkTeTVT3TljMktqo3TkS+tyOSVTUjXiz:WTv2F/J2Apfpo3TkStz
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ciasiis.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 8cbd96172613aa968f3c3f77ca8caf5d.exe -
Executes dropped EXE 1 IoCs
pid Process 4548 ciasiis.exe -
Adds Run key to start application 2 TTPs 50 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /q" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /R" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /Q" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /u" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /y" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /W" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /s" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /h" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /M" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /j" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /f" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /Y" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /x" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /D" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /l" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /m" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /B" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /r" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /P" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /c" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /L" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /V" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /g" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /o" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /T" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /p" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /N" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /O" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /C" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /S" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /A" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /t" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /Z" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /e" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /K" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /z" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /n" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /E" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /G" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /X" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /F" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /i" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /b" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /H" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /a" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /I" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /w" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /k" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /v" ciasiis.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciasiis = "C:\\Users\\Admin\\ciasiis.exe /U" ciasiis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe 4548 ciasiis.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4832 8cbd96172613aa968f3c3f77ca8caf5d.exe 4548 ciasiis.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4832 wrote to memory of 4548 4832 8cbd96172613aa968f3c3f77ca8caf5d.exe 86 PID 4832 wrote to memory of 4548 4832 8cbd96172613aa968f3c3f77ca8caf5d.exe 86 PID 4832 wrote to memory of 4548 4832 8cbd96172613aa968f3c3f77ca8caf5d.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbd96172613aa968f3c3f77ca8caf5d.exe"C:\Users\Admin\AppData\Local\Temp\8cbd96172613aa968f3c3f77ca8caf5d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\ciasiis.exe"C:\Users\Admin\ciasiis.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD57b98f3ffdd18813e6e94533a6448b79f
SHA1d20dab5b397fbaa206ef19bec7844973f7efd55b
SHA2561be69e3b00d42ff52e38385f8242405144761d961040395efac26ffbb1a6d9cc
SHA512f550a9d973c8629f5d7e99681413fc5d6c7330c6112889802f459e67bb18ed71531f171f5fb72607ef732ae32cdf3fa3a665d306e23b99380e4c8cc3deb03cf0