Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 08:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cafe76b7d4280c38a0f48d60a6aa2360.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cafe76b7d4280c38a0f48d60a6aa2360.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
cafe76b7d4280c38a0f48d60a6aa2360.exe
-
Size
152KB
-
MD5
cafe76b7d4280c38a0f48d60a6aa2360
-
SHA1
f1f2ed1e7727be9f47b5fe3cec0422d3bc8b7aed
-
SHA256
415fd81966d9fb37b0401b297179420fc6d41fdd899fbe79fa9dda36d5e81594
-
SHA512
fd1de289cca9fb448ac9d508201998714f47c0f4f5941372f425afdcab178bca2403a059cadfe8b19b84567bcddbf73c34626a42950bf48189cd13af2b700fee
-
SSDEEP
3072:ptDgFBCmeGMS6WLI3kTB58hahpkzFhPAOJ0NAW/pC4oQZiEoAV:kYmeGMS6Wc3kn9ADPAOJ0NJUWmS
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cafe76b7d4280c38a0f48d60a6aa2360.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" guibu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation cafe76b7d4280c38a0f48d60a6aa2360.exe -
Executes dropped EXE 1 IoCs
pid Process 1028 guibu.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /d" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /L" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /C" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /r" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /T" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /w" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /o" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /A" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /u" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /k" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /a" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /B" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /m" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /j" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /I" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /x" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /i" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /q" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /E" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /t" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /h" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /F" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /z" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /b" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /g" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /G" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /O" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /y" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /K" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /c" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /N" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /W" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /l" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /T" cafe76b7d4280c38a0f48d60a6aa2360.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /Y" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /V" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /p" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /J" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /P" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /H" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /D" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /s" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /f" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /e" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /S" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /Z" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /M" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /n" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /U" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /X" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /Q" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /v" guibu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guibu = "C:\\Users\\Admin\\guibu.exe /R" guibu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4236 cafe76b7d4280c38a0f48d60a6aa2360.exe 4236 cafe76b7d4280c38a0f48d60a6aa2360.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe 1028 guibu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4236 cafe76b7d4280c38a0f48d60a6aa2360.exe 1028 guibu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4236 wrote to memory of 1028 4236 cafe76b7d4280c38a0f48d60a6aa2360.exe 92 PID 4236 wrote to memory of 1028 4236 cafe76b7d4280c38a0f48d60a6aa2360.exe 92 PID 4236 wrote to memory of 1028 4236 cafe76b7d4280c38a0f48d60a6aa2360.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafe76b7d4280c38a0f48d60a6aa2360.exe"C:\Users\Admin\AppData\Local\Temp\cafe76b7d4280c38a0f48d60a6aa2360.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\guibu.exe"C:\Users\Admin\guibu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD5f6815888090f14301c9a1332fbd97af6
SHA1e5adc55d0562a0d823b63b0410ae32d18d13f30b
SHA256cb9a38c41b1505f50ef1e9ea5be21f9e3b073402231276612ab0e60ef8672ef7
SHA512b9f9af5e0c297853f07572d29184ec868a9dc5e3c36373cf055af47f4fc85be1104daedf0747aaee6a83fcf4e92b290e7c97b73c77b289fd5bc66fcfe8f7048c