Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe
-
Size
172KB
-
MD5
42ad8cd2bfc7f8910fa34ccde1e57556
-
SHA1
5968ec1a8de94cafe367741ffd9ac145b18a9529
-
SHA256
c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b
-
SHA512
89f1fcf7be28d5e7183db294da480110685102a78e4c7bd50d76afb08c59d2d0fdcb631a83d8a1abfc13ff62237af36ea2929e5be14c4a0bba46adc08d905a09
-
SSDEEP
3072:xCqQchV+4xLKGPQb6pLnq1AbpaMAePjT9273c0Iy8onzK98:ltpxLKGPQbWqliF27MHsKq
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xuomie.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe -
Executes dropped EXE 1 IoCs
pid Process 900 xuomie.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /w" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /g" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /i" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /v" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /z" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /q" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /k" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /t" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /g" c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /o" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /n" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /y" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /j" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /d" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /a" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /c" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /u" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /p" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /f" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /b" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /r" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /h" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /s" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /m" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /e" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /l" xuomie.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xuomie = "C:\\Users\\Admin\\xuomie.exe /x" xuomie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3948 c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe 3948 c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe 900 xuomie.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3948 c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe 900 xuomie.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3948 wrote to memory of 900 3948 c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe 88 PID 3948 wrote to memory of 900 3948 c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe 88 PID 3948 wrote to memory of 900 3948 c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe"C:\Users\Admin\AppData\Local\Temp\c0db73a321e6a8e7ea113abbeb7b5ef60a93ca5f168e56f2c898c5e62ea8700b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\xuomie.exe"C:\Users\Admin\xuomie.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD59c2586890798ac07eef7e7e49e685b5b
SHA1e961c72ca3b672fcdda2b6fcd3674838afb7baf1
SHA2569add960b42ddf67fc62393d5cee5045e5d81562611651a25b947d734a0d8b80a
SHA5129b7b081d80c1bdd090a9817e9c911c5fbb4fce3f9c679fd7b3efe9b16e39baf084a81f2a64d29a0a0c8186a84f8cbc45db185ab00394f8f03e3a081f3d5e4e4e