Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe
-
Size
72KB
-
MD5
2c5ab7f122ce9590dda2287269504a2f
-
SHA1
d6ba77dc83408baa2b26b2481fee78a51ad8558a
-
SHA256
2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50
-
SHA512
3c779801c17590a56fdd5b38821b10cb44355122d2c356bc61c7cb43833e3c1f89394c8adf83740bc09edb5a790b81d39a53e972df3a5dd2e399992ec38e9b4f
-
SSDEEP
1536:xAyToPledgGkAlSt9yzkwUk6Nr5kEHIwAr:3hgRAlStYzkrJNFkEHC
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ealleabab-egix.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\ubrooveam.exe" ealleabab-egix.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} ealleabab-egix.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\uhkakus.exe" ealleabab-egix.exe -
Executes dropped EXE 2 IoCs
pid Process 996 ealleabab-egix.exe 2224 ealleabab-egix.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ealleabab-egix.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ealleabab-egix.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ealleabab-egix.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ealleabab-egix.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ealleabab-egix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\oskeakoar-avoas.dll" ealleabab-egix.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\oskeakoar-avoas.dll ealleabab-egix.exe File created C:\Windows\SysWOW64\ealleabab-egix.exe 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe File created C:\Windows\SysWOW64\uhkakus.exe ealleabab-egix.exe File opened for modification C:\Windows\SysWOW64\ubrooveam.exe ealleabab-egix.exe File created C:\Windows\SysWOW64\ubrooveam.exe ealleabab-egix.exe File opened for modification C:\Windows\SysWOW64\oskeakoar-avoas.dll ealleabab-egix.exe File opened for modification C:\Windows\SysWOW64\ealleabab-egix.exe ealleabab-egix.exe File opened for modification C:\Windows\SysWOW64\ealleabab-egix.exe 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe File opened for modification C:\Windows\SysWOW64\uhkakus.exe ealleabab-egix.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 2224 ealleabab-egix.exe 2224 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe 996 ealleabab-egix.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 996 ealleabab-egix.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 996 5108 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 83 PID 5108 wrote to memory of 996 5108 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 83 PID 5108 wrote to memory of 996 5108 2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe 83 PID 996 wrote to memory of 2224 996 ealleabab-egix.exe 84 PID 996 wrote to memory of 2224 996 ealleabab-egix.exe 84 PID 996 wrote to memory of 2224 996 ealleabab-egix.exe 84 PID 996 wrote to memory of 616 996 ealleabab-egix.exe 5 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56 PID 996 wrote to memory of 3500 996 ealleabab-egix.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe"C:\Users\Admin\AppData\Local\Temp\2e08a6f3a8ee4427b25aa23c02ea5771dfe9e921163e5aa1a329f9d233379a50.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\ealleabab-egix.exe"C:\Windows\SysWOW64\ealleabab-egix.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\ealleabab-egix.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2224
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD587f47f45e3c076d02a5fb4db12247dd8
SHA19fba74a9df64ce0a61903ff51d34d38270686575
SHA2568d38b4f0aab60ad02fcfbc3ab38f5b84e2eca20270129511de7a7e635e9a831b
SHA5126e8737ef05436b3687ed3b7ae5a53d531d77d1bd8c68b81de93cf6a1938b77bf0e1de0e9f317221c9e529390d19843fb6dc958e3a4a39a961ec93beb210c39a6
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD5c5b7810ad12d98b2e28d6038b78eb205
SHA1ad349db78a8f8a32e13aea0f8a309d5fc1deebfa
SHA256fa4fa186439539b829efabf96e236f4ebc84fe82b82db822d204715cb7568602
SHA51237868870f3368a56ff567af978280413c7aa9a518baea0cefe4d1407b1df2a9b455ca86df706b358cb74fa768d3af3aa9fcb534c8b028ccaffc777450706f674
-
Filesize
73KB
MD59a361ea2cc0d427a45b8f642a54167cc
SHA131652fd02e008b72ab506bbcb08331f8e624aeea
SHA256f3c3d36632fcd02f32aca60e2e0ab9764ee6fde5e51354316cff917b9c1e39ea
SHA51206f415fd2a892f06cdda52b276e67eb06588c940a7d46051e45007c94bb3afaf455d41c503ba6e40fb8405500daea5f322059d1afd4c6fd68e4ddbe41c42cd17