Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe
-
Size
220KB
-
MD5
a298f5001ee8009f7ffc9f8679eab574
-
SHA1
f32f0c1914c075a1ee21ac79ed2f91b8d6e2c4ed
-
SHA256
aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414
-
SHA512
5322839dcb35cecc71f65e65cb41d2bf765561e96413bcda57da7db909f92d398bee9cfdff92b3a51258394f6ffa14e50c0c5e38c4007519b80644ef3e4cb296
-
SSDEEP
6144:d/n/Ayc5mFpvMTuGSouFQIlzBI1Iq3Fdrj6DUKSpFw+x:5/9c5mFpxzBI1X3Fdrj6DUKSpx
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cooitu.exe -
Executes dropped EXE 1 IoCs
pid Process 2080 cooitu.exe -
Loads dropped DLL 2 IoCs
pid Process 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /y" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /t" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /c" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /j" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /n" aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /u" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /x" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /h" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /d" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /k" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /p" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /b" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /e" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /g" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /r" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /m" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /w" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /v" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /o" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /s" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /n" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /z" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /l" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /i" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /f" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /a" cooitu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cooitu = "C:\\Users\\Admin\\cooitu.exe /q" cooitu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe 2080 cooitu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe 2080 cooitu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2080 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe 28 PID 1676 wrote to memory of 2080 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe 28 PID 1676 wrote to memory of 2080 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe 28 PID 1676 wrote to memory of 2080 1676 aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe"C:\Users\Admin\AppData\Local\Temp\aaffc0457fd9b13a3ea1454ab0886c11ebedf92236db4b59d7a955e913c67414.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\cooitu.exe"C:\Users\Admin\cooitu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5e6b86a05f5e6896f23d2d1ba44b18425
SHA19a4db0647bcd41550f24a57ac72010b6f96321ed
SHA2562b4a458491e2e325d030920683ec1e3394df042970b7640707d734d565c3e2f7
SHA512f2d86bfd36f3d1ba5148bb6a4697c403e73a3ac0ca43f06ffc77f3d661fd849ae3927b09ced2839437d0a7c51e74c300c2f95d038038a5e9464d830d9a63e7c2