Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 02:44

General

  • Target

    ae5cabd9e8c10af2054adb00ca3af8aec5e9d6baa8a3dff1048b270671a0ae4a.exe

  • Size

    53KB

  • MD5

    45c5c3b37c7daa38c507bf711d078879

  • SHA1

    11a8546bf3179e9e92c70cb1e91cdc7440552473

  • SHA256

    ae5cabd9e8c10af2054adb00ca3af8aec5e9d6baa8a3dff1048b270671a0ae4a

  • SHA512

    a769f322394989207be9cc2ac46f92d5e074d99881dac656c97014ecaa2ba8fb0276b0f585111e04826588f1df73768a4b0cd172e4a6f154e6cfdcbd6fc82e18

  • SSDEEP

    1536:vN6g8r8Q4piW7Kp3StjEMjmLM3ztDJWZsXy4JzxPMU:xpiWJJjmLM3zRJWZsXy4Jd

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae5cabd9e8c10af2054adb00ca3af8aec5e9d6baa8a3dff1048b270671a0ae4a.exe
    "C:\Users\Admin\AppData\Local\Temp\ae5cabd9e8c10af2054adb00ca3af8aec5e9d6baa8a3dff1048b270671a0ae4a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\kuiqii.exe
      "C:\Users\Admin\kuiqii.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\kuiqii.exe

    Filesize

    53KB

    MD5

    51f8b714a78dee10d615a1796ca9c66b

    SHA1

    722e8dc89ff4ce3fbbd2f185dea86b9fbc4d36b8

    SHA256

    6fe666c00bab281aea514af631e844c49e4c432cdb16e28113b10d2572dba3b7

    SHA512

    33e54c48cd2646e9d849095421d98d529d1507f2c6ca157d1a1b6efd455a86075a268973d0b0f9829260cb5f386f04050daaf71903f8d3807af4cfb1bb291907

  • memory/3324-34-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4496-0-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB