Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d23848def89126e1313672c44c02f07.exe
Resource
win7-20240319-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d23848def89126e1313672c44c02f07.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0d23848def89126e1313672c44c02f07.exe
-
Size
340KB
-
MD5
0d23848def89126e1313672c44c02f07
-
SHA1
d3a7d3b023158b631b24bb1fa1daa18aa7e64c15
-
SHA256
5fdb64a7a0f92d15693dad8166756353745ec9323b76364986a991283efbbdc6
-
SHA512
87c95770af94962ab367068f7b81c907e43450a237494198e60746e88c0c354ffe70899391c60d0a3212c08aea1ac7cf93e26ab1fb89ee0b52d31d04ff615e9e
-
SSDEEP
6144:VFyR9SLkWor+akVC5s/durgm7hv8htqiXkIvaX/m7bfTWaUspmHjYT9oFv6wHH/f:bI9SLkWor+akVC5s/dIdEhtqiXkIvaXr
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0d23848def89126e1313672c44c02f07.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vuoav.exe -
Executes dropped EXE 1 IoCs
pid Process 2192 vuoav.exe -
Loads dropped DLL 2 IoCs
pid Process 1728 0d23848def89126e1313672c44c02f07.exe 1728 0d23848def89126e1313672c44c02f07.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /d" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /M" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /I" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /q" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /u" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /A" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /j" 0d23848def89126e1313672c44c02f07.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /W" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /h" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /b" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /L" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /H" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /y" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /l" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /j" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /E" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /z" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /J" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /a" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /o" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /w" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /t" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /r" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /P" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /F" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /k" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /Z" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /X" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /D" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /i" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /s" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /R" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /x" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /Q" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /T" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /K" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /m" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /C" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /c" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /G" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /U" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /g" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /n" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /p" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /V" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /e" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /Y" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /N" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /f" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /v" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /B" vuoav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\vuoav = "C:\\Users\\Admin\\vuoav.exe /O" vuoav.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1728 0d23848def89126e1313672c44c02f07.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe 2192 vuoav.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1728 0d23848def89126e1313672c44c02f07.exe 2192 vuoav.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2192 1728 0d23848def89126e1313672c44c02f07.exe 28 PID 1728 wrote to memory of 2192 1728 0d23848def89126e1313672c44c02f07.exe 28 PID 1728 wrote to memory of 2192 1728 0d23848def89126e1313672c44c02f07.exe 28 PID 1728 wrote to memory of 2192 1728 0d23848def89126e1313672c44c02f07.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d23848def89126e1313672c44c02f07.exe"C:\Users\Admin\AppData\Local\Temp\0d23848def89126e1313672c44c02f07.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\vuoav.exe"C:\Users\Admin\vuoav.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD5277d0cac2d4f3de917159d2aa1d13a8d
SHA1c713671aecaa5fb93b98512d6f1d4d1004462b47
SHA2569cac77828f85f142f5ca2a355799972d5e57477ecf8be310abe9c7a53ff71215
SHA512b4fa82197847a307a015d4c3453a33b3acd4ba983d643254f02277e6e07d325d2a4c0cb0e2a0159f794f7afc08c50da4d145370b9dece67fc999af2add7094e8