Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 17:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe
-
Size
120KB
-
MD5
d4b7fc48ed42f8e66b2b0d289c825167
-
SHA1
04fcdcd79b39458e23dfa89eedb32f525d345323
-
SHA256
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b
-
SHA512
99a123d7dbcea5c59f5ae92f330a4f6a20a7140b4d8aa4e7ef5cc2358a934172ba231495e38fefcd53511cd0a3787adfb5d92e35a335cf5f7c7bb691b03d68dd
-
SSDEEP
3072:56v7777777777777777H77777777777777777777777777777tUaIqcNBcDL:eUaILNBcX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nioecem.exe -
Executes dropped EXE 1 IoCs
pid Process 3024 nioecem.exe -
Loads dropped DLL 2 IoCs
pid Process 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /f" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /v" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /i" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /a" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /x" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /u" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /z" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /m" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /p" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /k" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /g" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /y" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /t" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /j" 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /c" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /q" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /n" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /h" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /w" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /l" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /r" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /e" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /j" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /d" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /s" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /o" nioecem.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nioecem = "C:\\Users\\Admin\\nioecem.exe /b" nioecem.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe 3024 nioecem.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 3024 nioecem.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 916 wrote to memory of 3024 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 28 PID 916 wrote to memory of 3024 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 28 PID 916 wrote to memory of 3024 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 28 PID 916 wrote to memory of 3024 916 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe"C:\Users\Admin\AppData\Local\Temp\1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\nioecem.exe"C:\Users\Admin\nioecem.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD52a9fb3ae123858a6a80c8260bdc50343
SHA1aeb195f79039c62a5885fdb1f86e31860104a997
SHA2560002642bdff696ec3240aa68c1984dc6e1ad3b32a12618582e13ea64903ab30d
SHA512bd67dfd9c95ec267356a8670b421b945699fb810ca5ef740ec749303bf17ee9d17cc60e8b128cf2a317e50bcb207a03a6df0f4a97eb19e3d563599d9d8fb303d