Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 23:22
Static task
static1
Behavioral task
behavioral1
Sample
90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe
Resource
win10v2004-20240226-en
General
-
Target
90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe
-
Size
204KB
-
MD5
45b593a6c6918d963cc9ebdd5d1ac6ff
-
SHA1
800f0104f1c0055ed700fd2c5fb4211096932568
-
SHA256
90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0
-
SHA512
e546956ea56e950185d208f87a3f01a6d99a69d240025150744a035e5ebc2078adea81147a1a99cc270133b9ffc0acd09315790ffacb504f25df96611eea5f8b
-
SSDEEP
3072:mmHW800tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWVoZ:B2H4QxL7B9W0c1RCzR/fSmluK
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" leaviu.exe -
Executes dropped EXE 1 IoCs
pid Process 1984 leaviu.exe -
Loads dropped DLL 2 IoCs
pid Process 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /f" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /a" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /c" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /x" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /q" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /l" 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /w" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /v" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /h" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /e" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /g" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /y" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /r" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /j" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /l" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /k" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /d" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /p" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /n" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /z" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /m" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /u" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /t" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /i" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /o" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /b" leaviu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\leaviu = "C:\\Users\\Admin\\leaviu.exe /s" leaviu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe 1984 leaviu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe 1984 leaviu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1984 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe 28 PID 2012 wrote to memory of 1984 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe 28 PID 2012 wrote to memory of 1984 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe 28 PID 2012 wrote to memory of 1984 2012 90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe"C:\Users\Admin\AppData\Local\Temp\90dfa1053e87c34c6f0348cfdf179c4830cd0cdcebbcb793f9759c7f80b701a0.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\leaviu.exe"C:\Users\Admin\leaviu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5d692988f7a88952636bb54b1a5e9aaef
SHA17bed4678c3afcf98f60fcea397f44f3d81ba770b
SHA25659dd2fb43628a6c79e90ee115ebd922dec9fc34395bcafd28af6b69b5e503534
SHA51273ad1c6ec9d65b3045c2f7fa855cac01967fad98eda46d92e30ddcd455f7cfb076efe01e0847863303e76815b34eba5551b3e869be666a263800e83f3d7c7b65