Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe
Resource
win10v2004-20240226-en
General
-
Target
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe
-
Size
188KB
-
MD5
d2e14ee9cce5f853c9030fad44379424
-
SHA1
68cc4586304f48a0bb057f75d9acac2c3d25b3b3
-
SHA256
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38
-
SHA512
fba4c9b9daa3b549e35ef551a6022c0066ef7194f31a51dc5dc3ed4579c5704295c889422c93d9f2e3e57fe73d4f8970b86667b21a935a71ea3e3c234cd26a8c
-
SSDEEP
3072:K7fyp+k5ROnFVR5pY0hrDGILpLI0M/Dk4KrfXRdjnbk9bOlezfQnFTTvprw1Wevd:K76p+7CKs0tzXRdjbk9bbyvprww8W
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reook.exe -
Executes dropped EXE 1 IoCs
pid Process 2084 reook.exe -
Loads dropped DLL 2 IoCs
pid Process 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /x" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /p" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /Z" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /u" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /X" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /K" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /c" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /V" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /j" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /t" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /J" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /N" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /k" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /G" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /O" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /E" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /f" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /b" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /T" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /B" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /m" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /U" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /W" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /n" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /r" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /F" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /A" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /S" 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /R" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /z" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /g" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /P" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /M" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /h" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /l" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /Y" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /Q" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /s" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /L" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /v" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /D" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /y" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /e" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /S" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /o" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /d" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /H" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /C" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /q" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /i" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /I" reook.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\reook = "C:\\Users\\Admin\\reook.exe /w" reook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe 2084 reook.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 2084 reook.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2084 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 28 PID 1636 wrote to memory of 2084 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 28 PID 1636 wrote to memory of 2084 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 28 PID 1636 wrote to memory of 2084 1636 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe"C:\Users\Admin\AppData\Local\Temp\90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\reook.exe"C:\Users\Admin\reook.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD50a15197df75677b51aab0578741c0876
SHA1af4692cf2f190d2ed27a40ecb5df8e4b3a8b51b3
SHA256cbea2788b8f4290fb1c08e19103e39da1098fa9c228c1cedadcfaabc92a82683
SHA512fbd3420a686cfcfb97a84fd71a7cba36d0c431b653c45879abacd80eef45ccd4eead2e27aa0497e3bde8e4ebb072a748c02d3eec46ef1b520cfa5f94a1bdd915