Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 21:38
Static task
static1
Behavioral task
behavioral1
Sample
61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe
Resource
win10v2004-20240226-en
General
-
Target
61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe
-
Size
236KB
-
MD5
29a351e473bde27c0ea1aabfad8e1190
-
SHA1
504d19e7b9bdb0e9785fd013e94236cb4269bc8f
-
SHA256
61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7
-
SHA512
cdcd4ecff9167016b4ee78b510657482a0c7a65e486b2e33c2c79a6e833aeaaf957ff1b84a6b9c0215bd6bdf57a935579d3b9389e42f72070a0f4af962733b7a
-
SSDEEP
3072:1W1brOJt3r4sRIfgNv99m/N7AHBrVzZEDcB/VX/4+QpY6:kiFckIfgN19m/N0F/VX/4+O
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" coaxic.exe -
Executes dropped EXE 1 IoCs
pid Process 2008 coaxic.exe -
Loads dropped DLL 2 IoCs
pid Process 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /j" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /s" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /v" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /u" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /b" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /f" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /k" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /x" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /l" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /z" 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /z" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /d" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /c" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /i" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /w" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /q" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /o" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /r" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /e" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /h" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /n" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /t" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /m" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /p" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /a" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /y" coaxic.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\coaxic = "C:\\Users\\Admin\\coaxic.exe /g" coaxic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe 2008 coaxic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe 2008 coaxic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2008 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe 28 PID 1244 wrote to memory of 2008 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe 28 PID 1244 wrote to memory of 2008 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe 28 PID 1244 wrote to memory of 2008 1244 61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe"C:\Users\Admin\AppData\Local\Temp\61b41f281da915117c23d048a821ddf7f6a3561188efc19850edd80089ba1ef7.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\coaxic.exe"C:\Users\Admin\coaxic.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5512a342b7c486dd60763af359b4f4416
SHA1e6d4c429ab39d497c9af56cc5fb6889ba79e1e3e
SHA2563968824d95d3582f2c455b44c734e5ebb4ac34a6f77ffc06ded0f5c3c0ad637c
SHA51240aede956b6056edb873daab213fef12f54a48da2bf351dfde88358b4037a335d0fc030aea691004208e0a98add4494131a758b5a68a3ed7d5ca09a165b184da