Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 21:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe
-
Size
204KB
-
MD5
1e3bca8a0a3c19aa05e66613d0192f5f
-
SHA1
ff0cbee34f8b833cab98134ebb0ae9bd10eeac78
-
SHA256
8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca
-
SHA512
be1873bfd579b00d4cf8fabe0ef13b01fd6bd8857eca1c70a1c2004c9552586d830e831f68d4e1ca785bbe53acab3020cbfa881aaf43d4b3a985f131fac6e02c
-
SSDEEP
3072:5mEW8uYH0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWVfY:g57w4QxL7B9W0c1RCzR/fSmluQ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeucu.exe -
Executes dropped EXE 1 IoCs
pid Process 1496 yeucu.exe -
Loads dropped DLL 2 IoCs
pid Process 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /r" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /m" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /k" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /i" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /a" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /w" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /u" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /f" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /l" 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /c" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /z" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /t" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /d" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /q" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /v" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /n" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /g" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /x" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /b" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /y" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /h" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /j" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /s" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /l" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /p" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /e" yeucu.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeucu = "C:\\Users\\Admin\\yeucu.exe /o" yeucu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe 1496 yeucu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe 1496 yeucu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2808 wrote to memory of 1496 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe 28 PID 2808 wrote to memory of 1496 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe 28 PID 2808 wrote to memory of 1496 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe 28 PID 2808 wrote to memory of 1496 2808 8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe"C:\Users\Admin\AppData\Local\Temp\8e7e2d0aaf432de598f202594d01fa57ed15f12389f10cf3f813e9bf7aa3c8ca.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\yeucu.exe"C:\Users\Admin\yeucu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54217a152d085f5bc2707a9669ec58f3e
SHA1e221ce3b120d4da615045146a7e25cadfb8c90cc
SHA25604a7709a7e6ddfda37ff351bcf4ec4d40e8c984c797a7afff457d5bc2cd3e799
SHA5128efed298d190110acbe7f7d8d9ed6c6ced9bf52d5e9d7e980805a34e2cb9a15955625e642a7200dc007c9dbeb6e134e171fa92cd5713a1122fe10944ea3232ca
-
Filesize
204KB
MD5683dd831f3c33fa440df69adf1abd3a7
SHA1aac463a3de42e7bc8a24eee82984fd51a663f257
SHA256fccfc42c03b06e934142cd99ac74284c750c84389acaddf881032d556eadde9f
SHA512e85335490d174fbf8efb785de5e77706e668a847e76881e51ab12231a498ca05803ac9532705b1582a84c60773c8affec64cb5ad52d125e805c69110f0edf2ba
-
Filesize
128KB
MD570423bc57b5f5291f822927ebfe74051
SHA12b9a180133dc8276926f7ff420a7b1386471457f
SHA256b56ae7a1cb6a7863e0b62fd41d5053fe565896a18679a04187bec93ce12a3e69
SHA51275a44faa8021c724607ec65bc14b754d7730565694980342f2bf9589dc22c236716758abb755afdf075c5321300ad641c668bfb390320d35290fc2468c3cee05
-
Filesize
126KB
MD5dd10fdb6257f1183786d7242468b35ea
SHA178f8f30c1c4d266bb7265c067816495ab9fbadea
SHA2564949c805fff4480344d2869122d37ff44c88b213276aa829a23c27d21f729d9a
SHA512535b397debcfb0f76f6c6f4cbe364c8cee005df9d2056998748ba1501d8884a6b20378129f5c6f92273613fa0a3c3a6e0183f283348627638d97ad1c153ebadd