Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe
Resource
win10v2004-20240226-en
General
-
Target
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe
-
Size
188KB
-
MD5
d2e14ee9cce5f853c9030fad44379424
-
SHA1
68cc4586304f48a0bb057f75d9acac2c3d25b3b3
-
SHA256
90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38
-
SHA512
fba4c9b9daa3b549e35ef551a6022c0066ef7194f31a51dc5dc3ed4579c5704295c889422c93d9f2e3e57fe73d4f8970b86667b21a935a71ea3e3c234cd26a8c
-
SSDEEP
3072:K7fyp+k5ROnFVR5pY0hrDGILpLI0M/Dk4KrfXRdjnbk9bOlezfQnFTTvprw1Wevd:K76p+7CKs0tzXRdjbk9bbyvprww8W
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ywpud.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe -
Executes dropped EXE 1 IoCs
pid Process 3912 ywpud.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /Z" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /n" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /K" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /a" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /l" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /O" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /X" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /A" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /w" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /D" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /t" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /c" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /L" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /J" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /M" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /n" 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /P" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /s" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /j" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /C" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /W" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /i" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /F" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /B" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /h" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /b" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /v" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /p" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /Q" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /S" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /g" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /E" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /m" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /f" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /z" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /G" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /H" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /o" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /I" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /k" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /r" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /e" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /Y" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /y" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /q" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /x" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /T" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /d" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /u" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /V" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /U" ywpud.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywpud = "C:\\Users\\Admin\\ywpud.exe /R" ywpud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5116 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 5116 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe 3912 ywpud.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5116 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 3912 ywpud.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5116 wrote to memory of 3912 5116 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 90 PID 5116 wrote to memory of 3912 5116 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 90 PID 5116 wrote to memory of 3912 5116 90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe"C:\Users\Admin\AppData\Local\Temp\90f83af1b9a84f96494b7e7a6298699710869efb6a7a892a6f66e4a251b0bb38.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\ywpud.exe"C:\Users\Admin\ywpud.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD5e32439edb7377fbe5591678ae84284f4
SHA1fdd75942315ca1bb3b2b6d2a6e5cc94850c903f6
SHA256bbabebf18d4479bd672ba0d211991d01a011d4ab4922ff04057ca1051a4d1dd5
SHA51285469905729614d364692e50ae21814971ad7dec1ef55d3666c43a1c69e0e030ffaf404772d1e5b3ac7260ae3e8325816d37b187b0832877622c7f61f3eedfb0