Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe
Resource
win10v2004-20240226-en
General
-
Target
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe
-
Size
400KB
-
MD5
825f6c628b0732455c04d467d9298e26
-
SHA1
822d1fa15d0efeb463a420bd2228f86f9adc861b
-
SHA256
62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5
-
SHA512
c9ea976224ed36eb9cdb80544fe2efdd0451477e9ca008fed9c8d7dea2e63d5356209d7ced7855194e0703a283c3f4dd1a23dd9c12cc4511b0b8fbe1b27d3c83
-
SSDEEP
6144:ZsYftV4tAyXuS/WiBWuVklOPce2imvDAPbBW6EWfQkmJyOj4ykpZq:fAdBFVkl6ItD4W6EWfQByOj4ykpZ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceiuj.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe -
Executes dropped EXE 1 IoCs
pid Process 4972 ceiuj.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /n" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /i" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /w" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /s" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /g" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /g" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /m" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /d" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /y" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /r" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /q" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /f" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /l" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /n" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /o" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /u" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /c" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /i" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /r" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /e" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /z" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /e" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /u" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /a" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /l" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /m" 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /b" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /t" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /c" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /y" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /k" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /d" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /s" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /j" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /p" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /t" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /f" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /z" 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /b" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /o" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /z" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /x" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /j" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /m" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /h" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /p" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /v" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /h" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /q" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /a" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /w" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /x" ceiuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /v" ceiuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ceiuj = "C:\\Users\\Admin\\ceiuj.exe /k" ceiuj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4784 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 4784 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe 4972 ceiuj.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4784 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 4972 ceiuj.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4784 wrote to memory of 4972 4784 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 93 PID 4784 wrote to memory of 4972 4784 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 93 PID 4784 wrote to memory of 4972 4784 62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe"C:\Users\Admin\AppData\Local\Temp\62cd46aa795b1866af35ed6b2f8e299210e23f0c3e5d0a5ba9e90acbec7a5ba5.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\ceiuj.exe"C:\Users\Admin\ceiuj.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400KB
MD51e07fd4f7023f5d4cfc30130fb09856f
SHA183d418410155ccee1a7925c5b71e04cbf33c3fac
SHA256a77cb37d8405808cc85c5dd8d230cce41eb501bbc48242679c71edd1d0788065
SHA512be34e5faedf72cd34f0a138d82813d8f81c9f8d7582f5a4206a6bb40d275a1578364a6b0e4a8965d7b95b81e37395b4a0aeadba21c79f4ee9b01de4bc5f6680d