Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 21:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe
-
Size
67KB
-
MD5
b0bad3c5d1ce3ecad7914d3ec32e4a82
-
SHA1
f957a18ed5b758017e635fb1407f037db4bb4418
-
SHA256
577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25
-
SHA512
e06fe9bbb21f905026f9b6a99e8ec475c9de2c3ea2c55dbce5622b0d0fe76a0ff9021725b1042af3d6787a7e3c1f635fd8249cfc610d04dac7766d0844883a79
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+dwY5b:ulg35GTslA5t3Gdwm
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ufratin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ufratin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ufratin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ufratin.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44544B55-544a-524c-4454-4B55544A524c}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ufratin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44544B55-544a-524c-4454-4B55544A524c}\IsInstalled = "1" ufratin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44544B55-544a-524c-4454-4B55544A524c}\StubPath = "C:\\Windows\\system32\\uxxexob.exe" ufratin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44544B55-544a-524c-4454-4B55544A524c} ufratin.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ihpakoab.exe" ufratin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ufratin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ufratin.exe -
Executes dropped EXE 2 IoCs
pid Process 1240 ufratin.exe 4932 ufratin.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ufratin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ufratin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ufratin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ufratin.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ufratin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ougvoacom.dll" ufratin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ufratin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ufratin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ufratin.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\uxxexob.exe ufratin.exe File opened for modification C:\Windows\SysWOW64\ougvoacom.dll ufratin.exe File opened for modification C:\Windows\SysWOW64\ihpakoab.exe ufratin.exe File created C:\Windows\SysWOW64\ihpakoab.exe ufratin.exe File opened for modification C:\Windows\SysWOW64\uxxexob.exe ufratin.exe File created C:\Windows\SysWOW64\ougvoacom.dll ufratin.exe File opened for modification C:\Windows\SysWOW64\ufratin.exe ufratin.exe File opened for modification C:\Windows\SysWOW64\ufratin.exe 577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe File created C:\Windows\SysWOW64\ufratin.exe 577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 4932 ufratin.exe 4932 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe 1240 ufratin.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2956 577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe Token: SeDebugPrivilege 1240 ufratin.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2956 wrote to memory of 1240 2956 577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe 87 PID 2956 wrote to memory of 1240 2956 577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe 87 PID 2956 wrote to memory of 1240 2956 577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe 87 PID 1240 wrote to memory of 4932 1240 ufratin.exe 88 PID 1240 wrote to memory of 4932 1240 ufratin.exe 88 PID 1240 wrote to memory of 4932 1240 ufratin.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe"C:\Users\Admin\AppData\Local\Temp\577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\ufratin.exe"C:\Windows\system32\ufratin.exe"2⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\ufratin.exeùù¿çç¤3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5943a555a6cda125c71dfdf8d7ad2e59f
SHA1909c5e2806fe639f758740a7039297f563acdc41
SHA2569224cd0f73aebfef9f8f0afce2ec6a94b6fefc943af78db3535a281e94dbc205
SHA512d160b11cb59add1b40b9efd94c925966345292dc26327ee8f702b7e359f4cb814341d728de2efe40792adb319b0c79c695854ad8763004bdd91c5c9af7528cf3
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
67KB
MD5b0bad3c5d1ce3ecad7914d3ec32e4a82
SHA1f957a18ed5b758017e635fb1407f037db4bb4418
SHA256577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25
SHA512e06fe9bbb21f905026f9b6a99e8ec475c9de2c3ea2c55dbce5622b0d0fe76a0ff9021725b1042af3d6787a7e3c1f635fd8249cfc610d04dac7766d0844883a79
-
Filesize
69KB
MD58ec14d90db2cde148cab6d411e766b76
SHA1102d1b679e48de41c76653c340b50d91e0f5b4e8
SHA2568a1a56e78fc1f14ba6473b61156eb68c56d6a343a4cadd5695dddc3a6dd7ec7c
SHA5126930474ee37e8e07bc6ed9f575aab7ebe6215a9c8976e181651dfe21bc3193567af3d902895a6a16f2dcee9a5c7958c3c1f79c84a9a9144ea34176d4ed3a6973