Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe
-
Size
204KB
-
MD5
ebe4ff7f51a8047864eb26e0ea83f65f
-
SHA1
0d54af8cde9a68e17c17a729605187a9c618fa3d
-
SHA256
7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374
-
SHA512
b30357fc8d2d99982e16fb163f9eeec3294290305e278dbb5bf74393806bc3b98c43ee33264229d3027077f8a71b60f06d73d68083af11787b5f9a0d2e792151
-
SSDEEP
1536:JH+OogHo1vzxHwxhjoxNy3tQ9CW5EZWHakMwP9W6uXNh9h1AWa11GBPIdRONd+wl:ZHo1m00tQ9nLHbB9WTk9+JgqmltqV
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" koobo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe -
Executes dropped EXE 1 IoCs
pid Process 3260 koobo.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /h" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /p" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /n" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /f" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /v" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /y" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /b" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /c" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /l" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /x" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /u" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /o" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /g" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /j" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /a" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /e" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /r" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /d" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /i" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /o" 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /q" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /m" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /t" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /w" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /k" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /s" koobo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koobo = "C:\\Users\\Admin\\koobo.exe /z" koobo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3504 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe 3504 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe 3260 koobo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3504 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe 3260 koobo.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3504 wrote to memory of 3260 3504 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe 99 PID 3504 wrote to memory of 3260 3504 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe 99 PID 3504 wrote to memory of 3260 3504 7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe"C:\Users\Admin\AppData\Local\Temp\7fb9c14b8723a838de6d3d9c3dfac2c69f4c78cfeb5c1c4d0aaaeb476a6ed374.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\koobo.exe"C:\Users\Admin\koobo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1332 --field-trial-handle=2268,i,8796662530135712346,11409037572378858775,262144 --variations-seed-version /prefetch:81⤵PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5c776de713643aa95f191ccea0e7b88ad
SHA13c8397265c246e7a25849aca45c863ac5415f29c
SHA2566b5992c354b982064376e4228170df4651fe9d63deabf53e1aea18c22fd4dfef
SHA512f0e78f4a50ff353b1f30a6f80d922c59670efddc51752524455a1ff29715c8dfdfe7efee93c87c6a5f4dc52a45787f5b4d456bcff1251ac82eb7b2ed25532c96