Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/03/2024, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
b253fe41b9c0ed7fbe3a8e2f38bcd864.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b253fe41b9c0ed7fbe3a8e2f38bcd864.exe
Resource
win10v2004-20240226-en
General
-
Target
b253fe41b9c0ed7fbe3a8e2f38bcd864.exe
-
Size
108KB
-
MD5
b253fe41b9c0ed7fbe3a8e2f38bcd864
-
SHA1
840a9a95fb366ef1ca19760d2b12c8937cedf416
-
SHA256
73e506879a2d33b72c2dce161ff27fef46fc753d9a2dfc5590df3282bfc73ee0
-
SHA512
9ccd560927ef21dba09cdd0d35c7f01146e3377dfb9afdfff18fa33c0a136bd0e7ad0b787a1d451d1afa85fda1bb7c1bb95b1800a22732e96a1ee8f5f4387bb7
-
SSDEEP
768:MyV+hOvI80wziAgjzIWi3KEyUhL7b7Yqlf4JwQltjmtTBHi7Alz:MoFvJ/Y876Ezh/vYlJwAitTB3lz
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hauca.exe -
Executes dropped EXE 1 IoCs
pid Process 2832 hauca.exe -
Loads dropped DLL 2 IoCs
pid Process 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\hauca = "C:\\Users\\Admin\\hauca.exe" hauca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2340 2780 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe 2832 hauca.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 2832 hauca.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2832 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 28 PID 2780 wrote to memory of 2832 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 28 PID 2780 wrote to memory of 2832 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 28 PID 2780 wrote to memory of 2832 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 28 PID 2780 wrote to memory of 2340 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 29 PID 2780 wrote to memory of 2340 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 29 PID 2780 wrote to memory of 2340 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 29 PID 2780 wrote to memory of 2340 2780 b253fe41b9c0ed7fbe3a8e2f38bcd864.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2780 2832 hauca.exe 27 PID 2832 wrote to memory of 2340 2832 hauca.exe 29 PID 2832 wrote to memory of 2340 2832 hauca.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b253fe41b9c0ed7fbe3a8e2f38bcd864.exe"C:\Users\Admin\AppData\Local\Temp\b253fe41b9c0ed7fbe3a8e2f38bcd864.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\hauca.exe"C:\Users\Admin\hauca.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 8042⤵
- Program crash
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5dab10ecc3b2078af4ea7161ff2944f9c
SHA105759c3e1d34ccd4c623d2105d68e5f306140d42
SHA256aea9a29bd5c19f0b3d41e5cd789937539064ea0083b9b3d2a2c5e5b4868170bd
SHA512dfe71dde4ce584daf4310ee705bdf92b615fd9542fc2ab56dd36aab2ec026eeaa376990a230e6b08d29bca27cb88a19fd07daef9febb4de90762beaa8afb5a4e