Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 17:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe
-
Size
120KB
-
MD5
d4b7fc48ed42f8e66b2b0d289c825167
-
SHA1
04fcdcd79b39458e23dfa89eedb32f525d345323
-
SHA256
1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b
-
SHA512
99a123d7dbcea5c59f5ae92f330a4f6a20a7140b4d8aa4e7ef5cc2358a934172ba231495e38fefcd53511cd0a3787adfb5d92e35a335cf5f7c7bb691b03d68dd
-
SSDEEP
3072:56v7777777777777777H77777777777777777777777777777tUaIqcNBcDL:eUaILNBcX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" riixu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe -
Executes dropped EXE 1 IoCs
pid Process 2424 riixu.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /x" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /k" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /f" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /d" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /v" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /j" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /i" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /a" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /h" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /l" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /o" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /q" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /b" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /e" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /c" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /g" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /z" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /t" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /y" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /p" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /w" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /m" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /s" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /n" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /r" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /u" riixu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\riixu = "C:\\Users\\Admin\\riixu.exe /v" 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 3024 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe 2424 riixu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3024 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 2424 riixu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2424 3024 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 93 PID 3024 wrote to memory of 2424 3024 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 93 PID 3024 wrote to memory of 2424 3024 1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe"C:\Users\Admin\AppData\Local\Temp\1a0bbfe34ffe7814b010aac7f3a9557ec81a2757b78adad3686de429b1bddd3b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\riixu.exe"C:\Users\Admin\riixu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD527dd44ce5bda570a3e2024579683ad11
SHA141123dbfef796cbe952041550961a5e940ca0d3e
SHA256c523137deadb22dfe14c2448656b286f9b983d0b924214c303bfc28d7a06d636
SHA5122dceea0081b50d815f1b2254f0eeee8daf621f056cec4bf8edda0b6921dc8bdd67e54f042c5dd12b5c88fc148db1df8879b8fd61f1af424ac3f01b00ac1b8cbc