Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 19:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe
-
Size
92KB
-
MD5
00c3fe0bdda5fbd589a2e615656a9b98
-
SHA1
fe8330cb84becea449574ad25df50283fee15956
-
SHA256
20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1
-
SHA512
afe3ea5a32ed47b5905dfada72823aad50a2b7fa04593f7373425d271050f21ac96d56366d4f283e3eae80af3eb486813085109e46497a5ecce7c8de6e6da873
-
SSDEEP
1536:NkxBKTbKsZLyJxFdhXgI0TRQP/FY0Y6Y2YkYGYHRHNxtwv4RaoacXcmKd9Qa:cKTbDpCH6QP/uRNBcbd
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" niuviuk.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe -
Executes dropped EXE 1 IoCs
pid Process 4088 niuviuk.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /H" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /N" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /J" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /G" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /U" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /P" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /T" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /F" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /Y" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /V" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /I" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /X" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /d" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /E" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /s" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /g" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /w" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /u" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /t" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /A" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /m" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /y" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /b" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /O" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /L" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /a" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /S" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /e" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /R" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /r" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /z" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /l" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /Z" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /j" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /c" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /i" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /M" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /B" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /x" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /W" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /v" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /n" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /o" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /h" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /D" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /Q" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /q" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /k" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /p" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /f" niuviuk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niuviuk = "C:\\Users\\Admin\\niuviuk.exe /K" niuviuk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe 4088 niuviuk.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 452 20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe 4088 niuviuk.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 452 wrote to memory of 4088 452 20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe 91 PID 452 wrote to memory of 4088 452 20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe 91 PID 452 wrote to memory of 4088 452 20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe"C:\Users\Admin\AppData\Local\Temp\20936d2ecded668d90e9097e325e71b4e0eaa0d71f56269a0560a05aff4242b1.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\niuviuk.exe"C:\Users\Admin\niuviuk.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:3860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5ce878b2f942aa8cd16f92d40b29de46f
SHA1a69689a01670a978bf3f6ce24eb17b4c299e066b
SHA2567ce9d8c5b897ef060a2ad151ec7264f73dd1d1a0032911577d411637b3cc9a47
SHA512cf407828db79a649e557a4a6d581a3c02f0bfb4b97c3daaa6bd0e98dcff9c53e1cdb90cfacd14e720f943fdb1bf539f481ef26bbc181fc24b1764db765359a4c