Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe
-
Size
72KB
-
MD5
066858d7dedd390b8fdde347971c9f32
-
SHA1
1909ff5bc20b7609d4d95011c02391fab5146136
-
SHA256
d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5
-
SHA512
6e0e1a070a04a7fbce109f4614e8f27da0523fbffb35b25f39e442d28cbe6429a6ab34390acfa476469b1e9825f8c49f8ff3a08f4144e6ecddf9174130aa8af8
-
SSDEEP
768:x/n2kOjjhB/9BIGwsSsNsOu3uwng7GIWsT/C9BJc3meUcWN075RrLhdP24wgsiEU:xJOjjhh7InsXDDVTWBeHWN075RxFJYY
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouhturuc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouhturuc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouhturuc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouhturuc.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643} ouhturuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ouhturuc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1" ouhturuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\arxooroam-idoab.exe" ouhturuc.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ouhturuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ouhturuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ivhamic.exe" ouhturuc.exe -
Executes dropped EXE 2 IoCs
pid Process 3024 ouhturuc.exe 2512 ouhturuc.exe -
Loads dropped DLL 3 IoCs
pid Process 2920 d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe 2920 d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe 3024 ouhturuc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouhturuc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouhturuc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouhturuc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouhturuc.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ouhturuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ouhturuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ouvvidug.dll" ouhturuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ouhturuc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ouhturuc.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ouhturuc.exe d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe File opened for modification C:\Windows\SysWOW64\ivhamic.exe ouhturuc.exe File created C:\Windows\SysWOW64\arxooroam-idoab.exe ouhturuc.exe File created C:\Windows\SysWOW64\ouhturuc.exe d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe File created C:\Windows\SysWOW64\ivhamic.exe ouhturuc.exe File opened for modification C:\Windows\SysWOW64\arxooroam-idoab.exe ouhturuc.exe File opened for modification C:\Windows\SysWOW64\ouvvidug.dll ouhturuc.exe File created C:\Windows\SysWOW64\ouvvidug.dll ouhturuc.exe File opened for modification C:\Windows\SysWOW64\ouhturuc.exe ouhturuc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 2512 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe 3024 ouhturuc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3024 ouhturuc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 3024 2920 d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe 28 PID 2920 wrote to memory of 3024 2920 d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe 28 PID 2920 wrote to memory of 3024 2920 d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe 28 PID 2920 wrote to memory of 3024 2920 d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe 28 PID 3024 wrote to memory of 436 3024 ouhturuc.exe 5 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 2512 3024 ouhturuc.exe 29 PID 3024 wrote to memory of 2512 3024 ouhturuc.exe 29 PID 3024 wrote to memory of 2512 3024 ouhturuc.exe 29 PID 3024 wrote to memory of 2512 3024 ouhturuc.exe 29 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21 PID 3024 wrote to memory of 1256 3024 ouhturuc.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe"C:\Users\Admin\AppData\Local\Temp\d3cd7c36e1f9c76a1ce0a24324bcf264806560930ff07fc56273ba7c63f706a5.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\ouhturuc.exe"C:\Windows\SysWOW64\ouhturuc.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\ouhturuc.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2512
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD511e5e4aaeffcad673b5f6f5e27b6be01
SHA1f3183d68ad957d0ba0f592ef39dc37577f762fcf
SHA256c808a3dc24279bf74687e4cc753b4de76dd8cdf6a1c456ae93804b6d0e3b4109
SHA51229c63f84df99aee485ebc0b3ebd5cab0ac686bc8d976810f03d6a43624d8b67b63eb112a9fe21ac5fbab2c2d8d4e526006e290f500f5920d0b772e49611f793d
-
Filesize
73KB
MD56e687958394bfe66d470ced5e2a2bfec
SHA1d52aa7a77360f1d2091032862f4de241df3e96c3
SHA2562cc96f60f13ae800751afa79f239ec88ca9dacead61370625e92ff0ee686a490
SHA512c321d4edbaccda2f7778e6e228d229bc065768d923d58386cfa7942e2cb0c55bebd7d54f7c3195e65089ff502f125cc5ee4c59c14cfcb9664d9d05482d81e9ce
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
70KB
MD55c2f0f6b2f4ef298b43976f8f7b188e0
SHA1b616df2a9284cdb315349e579dea9db7082cf00e
SHA25619386fe3e8150e1925ef6f84877441016a252d20e40beff32f35169d013cfa15
SHA512abb7765c523b9c36bb45ff7d8f4fdae9ac5d04948c497b58a726c4c1178c3ae0c018f2b064273139715a6b40cce32ff60d40df8dd399fe599ee616f43b4053bd