Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e4dc195deceacd3626bed07bd4dd840_NEAS.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e4dc195deceacd3626bed07bd4dd840_NEAS.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5e4dc195deceacd3626bed07bd4dd840_NEAS.exe
-
Size
71KB
-
MD5
5e4dc195deceacd3626bed07bd4dd840
-
SHA1
2c71a74cf2e2a453f71314a68fbebab7e1d5991e
-
SHA256
c551f0b139c150ef656fabba41822dcad3e9f694a4e6308be4f29096683c6925
-
SHA512
6473fcb22f72ec06910d95fcc46877e54d28e012d97ed9592e37a605b08126155bbcda3dadbd999e4ff7cc45c364837564bfe2ef0422310bc5d86defe2bf56be
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slC8:Olg35GTslA5t3/w8d8
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ounxanum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ounxanum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ounxanum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ounxanum.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450} ounxanum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ounxanum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\IsInstalled = "1" ounxanum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{495A4B43-4b4f-5450-495A-4B434B4F5450}\StubPath = "C:\\Windows\\system32\\aglooxeh.exe" ounxanum.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ounxanum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ounxanum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\udpofeah.exe" ounxanum.exe -
Executes dropped EXE 2 IoCs
pid Process 2196 ounxanum.exe 2524 ounxanum.exe -
Loads dropped DLL 3 IoCs
pid Process 2016 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe 2016 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe 2196 ounxanum.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ounxanum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ounxanum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ounxanum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ounxanum.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ounxanum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ounxanum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ounxanum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\onboohet.dll" ounxanum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ounxanum.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ounxanum.exe 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe File opened for modification C:\Windows\SysWOW64\udpofeah.exe ounxanum.exe File created C:\Windows\SysWOW64\udpofeah.exe ounxanum.exe File opened for modification C:\Windows\SysWOW64\ounxanum.exe ounxanum.exe File created C:\Windows\SysWOW64\ounxanum.exe 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe File opened for modification C:\Windows\SysWOW64\aglooxeh.exe ounxanum.exe File created C:\Windows\SysWOW64\aglooxeh.exe ounxanum.exe File opened for modification C:\Windows\SysWOW64\onboohet.dll ounxanum.exe File created C:\Windows\SysWOW64\onboohet.dll ounxanum.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2524 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe 2196 ounxanum.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2016 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe Token: SeDebugPrivilege 2196 ounxanum.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2196 2016 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe 28 PID 2016 wrote to memory of 2196 2016 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe 28 PID 2016 wrote to memory of 2196 2016 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe 28 PID 2016 wrote to memory of 2196 2016 5e4dc195deceacd3626bed07bd4dd840_NEAS.exe 28 PID 2196 wrote to memory of 436 2196 ounxanum.exe 5 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 2524 2196 ounxanum.exe 29 PID 2196 wrote to memory of 2524 2196 ounxanum.exe 29 PID 2196 wrote to memory of 2524 2196 ounxanum.exe 29 PID 2196 wrote to memory of 2524 2196 ounxanum.exe 29 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21 PID 2196 wrote to memory of 1248 2196 ounxanum.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\5e4dc195deceacd3626bed07bd4dd840_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\5e4dc195deceacd3626bed07bd4dd840_NEAS.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\ounxanum.exe"C:\Windows\system32\ounxanum.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\ounxanum.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD50db5bbd9adcd2b515177209cc3c8babd
SHA1ba40e0dae0d2b7efa3c947e761e107edc8d98e17
SHA256d04a4a8855f3eb57126bba76772ced4c457c75a756ee09c67636a3750ce090af
SHA512ce195aceb5cafb3c6ae05e8a563fcc8165c56fb45b4719d0417d7cc0d23c341752142783a24033d60d2870f28fb3b5ff75edd9b2f0e4dabd1d42e03a3cf10122
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
74KB
MD55a4951d68ef3b42577a8a464053a346a
SHA1c1b5febdbe6ed706d8b90f4704dc36e981e98455
SHA256f02a1b6e5ef093c1518d657209e564d4a277393288fa04aa445474f841f0ad49
SHA512044ffa55969f781511b8a27a39e5e5733c17ba5cb69adf46e29519faa0548191be7e06c075a23fb8661b424c6a6bd9ba13358fef5acab2d7de9c53af4aa01a15
-
Filesize
71KB
MD55e4dc195deceacd3626bed07bd4dd840
SHA12c71a74cf2e2a453f71314a68fbebab7e1d5991e
SHA256c551f0b139c150ef656fabba41822dcad3e9f694a4e6308be4f29096683c6925
SHA5126473fcb22f72ec06910d95fcc46877e54d28e012d97ed9592e37a605b08126155bbcda3dadbd999e4ff7cc45c364837564bfe2ef0422310bc5d86defe2bf56be