Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe
Resource
win10v2004-20220812-en
General
-
Target
bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe
-
Size
45KB
-
MD5
020891f9564e88267b002a4731429b4b
-
SHA1
154b6231dc8866917a633cb02814047df7b21df3
-
SHA256
bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1
-
SHA512
47cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55
-
SSDEEP
768:r9FyRBrXcPo0LomyVXyEDel8CYk4HV8jr5AJFNcy259f5FwekD8V9LgctsWkc9B/:PyDjcPaRVEGtkMV8/CJFNcyE9bwe08Vf
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mtklef = "{D236A703-6AF7-40F1-89BF-C0DE40C8922A}" boot.sys Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad boot.sys Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mtklefa = "{758FFBE2-B90C-483F-8CBE-E4F37312EAAB}" boot.sys Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\EBCGBIDD = "{43541208-1B55-2FA2-70CE-46FF7B816C28}" bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad boot.sys -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ndisrd.sys boot.sys File opened for modification C:\Windows\SysWOW64\drivers\ndisrd.sys boot.sys -
Executes dropped EXE 4 IoCs
pid Process 872 Apbcjo32.exe 672 boot.sys 1716 boot.sys 452 EBCGBIDD.exe -
resource yara_rule behavioral1/files/0x000500000000b2d2-59.dat upx behavioral1/files/0x000500000000b2d2-61.dat upx behavioral1/files/0x000500000000b2d2-63.dat upx behavioral1/files/0x000500000000b2d2-66.dat upx behavioral1/memory/1716-80-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 940 cmd.exe -
Loads dropped DLL 6 IoCs
pid Process 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 672 boot.sys 1716 boot.sys 872 Apbcjo32.exe 872 Apbcjo32.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\xslfdlnt.bat bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe File created C:\Windows\SysWOW64\Apbcjo32.exe bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe File opened for modification C:\Windows\SysWOW64\Apbcjo32.exe bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe File created C:\Windows\SysWOW64\Cpbmbc32.dll bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe File created C:\Windows\SysWOW64\gzvpo32.dll boot.sys File created C:\Windows\SysWOW64\lfcob32.dll boot.sys File created C:\Windows\SysWOW64\EBCGBIDD.exe Apbcjo32.exe -
Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{758FFBE2-B90C-483F-8CBE-E4F37312EAAB}\InprocServer32\ = "C:\\Windows\\SysWow64\\lfcob32.dll" boot.sys Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43541208-1B55-2FA2-70CE-46FF7B816C28}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpbmbc32.dll" bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D236A703-6AF7-40F1-89BF-C0DE40C8922A}\InprocServer32\ = "C:\\Windows\\SysWow64\\gzvpo32.dll" boot.sys Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43541208-1B55-2FA2-70CE-46FF7B816C28}\InProcServer32\ThreadingModel = "Apartment" bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{758FFBE2-B90C-483F-8CBE-E4F37312EAAB}\ boot.sys Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{758FFBE2-B90C-483F-8CBE-E4F37312EAAB}\InprocServer32 boot.sys Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{758FFBE2-B90C-483F-8CBE-E4F37312EAAB}\InprocServer32\ThreadingModel = "Apartment" boot.sys Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43541208-1B55-2FA2-70CE-46FF7B816C28}\InProcServer32 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D236A703-6AF7-40F1-89BF-C0DE40C8922A}\InprocServer32\ThreadingModel = "Apartment" boot.sys Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D236A703-6AF7-40F1-89BF-C0DE40C8922A}\InprocServer32 boot.sys Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{758FFBE2-B90C-483F-8CBE-E4F37312EAAB} boot.sys Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43541208-1B55-2FA2-70CE-46FF7B816C28} bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D236A703-6AF7-40F1-89BF-C0DE40C8922A} boot.sys Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D236A703-6AF7-40F1-89BF-C0DE40C8922A}\ boot.sys -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 672 boot.sys 1716 boot.sys -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 872 Apbcjo32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 672 boot.sys 1716 boot.sys -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1280 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 27 PID 1288 wrote to memory of 1280 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 27 PID 1288 wrote to memory of 1280 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 27 PID 1288 wrote to memory of 1280 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 27 PID 1288 wrote to memory of 872 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 28 PID 1288 wrote to memory of 872 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 28 PID 1288 wrote to memory of 872 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 28 PID 1288 wrote to memory of 872 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 28 PID 872 wrote to memory of 1748 872 Apbcjo32.exe 30 PID 872 wrote to memory of 1748 872 Apbcjo32.exe 30 PID 872 wrote to memory of 1748 872 Apbcjo32.exe 30 PID 872 wrote to memory of 1748 872 Apbcjo32.exe 30 PID 1280 wrote to memory of 672 1280 cmd.exe 32 PID 1280 wrote to memory of 672 1280 cmd.exe 32 PID 1280 wrote to memory of 672 1280 cmd.exe 32 PID 1280 wrote to memory of 672 1280 cmd.exe 32 PID 672 wrote to memory of 1208 672 boot.sys 18 PID 1748 wrote to memory of 1716 1748 cmd.exe 33 PID 1748 wrote to memory of 1716 1748 cmd.exe 33 PID 1748 wrote to memory of 1716 1748 cmd.exe 33 PID 1748 wrote to memory of 1716 1748 cmd.exe 33 PID 1716 wrote to memory of 1208 1716 boot.sys 18 PID 872 wrote to memory of 452 872 Apbcjo32.exe 34 PID 872 wrote to memory of 452 872 Apbcjo32.exe 34 PID 872 wrote to memory of 452 872 Apbcjo32.exe 34 PID 872 wrote to memory of 452 872 Apbcjo32.exe 34 PID 1288 wrote to memory of 940 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 35 PID 1288 wrote to memory of 940 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 35 PID 1288 wrote to memory of 940 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 35 PID 1288 wrote to memory of 940 1288 bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe 35
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe"C:\Users\Admin\AppData\Local\Temp\bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1.exe"2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C start c:\boot.sys3⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\boot.sysc:\boot.sys4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:672
-
-
-
C:\Windows\SysWOW64\Apbcjo32.exeC:\Windows\system32\Apbcjo32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C start c:\boot.sys4⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\boot.sysc:\boot.sys5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1716
-
-
-
C:\Windows\SysWOW64\EBCGBIDD.exeC:\Windows\system32\EBCGBIDD.exe C:\Windows\SysWOW64\Apbcjo32.exe4⤵
- Executes dropped EXE
PID:452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C C:\Windows\system32\xslfdlnt.bat3⤵
- Deletes itself
PID:940
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5020891f9564e88267b002a4731429b4b
SHA1154b6231dc8866917a633cb02814047df7b21df3
SHA256bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1
SHA51247cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55
-
Filesize
45KB
MD5020891f9564e88267b002a4731429b4b
SHA1154b6231dc8866917a633cb02814047df7b21df3
SHA256bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1
SHA51247cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55
-
Filesize
13KB
MD53c3441990e0bf0eada3a93de7bb6b829
SHA11642694577d033cd73c0348b8754ce5403dc6530
SHA256852e1896be3f1be4483c058c94c179cbf2ffeea8d8d7b574ee54934950330121
SHA5120c4218b51f61fffb148d28f858b087fa07fe561b54b3988f379339f8ce6649fad36fff3c3f620e23efda213ce5475b0d823f157dd4e47b30226fb078563165b0
-
Filesize
14KB
MD562d4ef02daab1e5a32a2dee911bbb8a2
SHA199eb26074ef938a8474aaa2ee57687044772f093
SHA256f70bc344cad6386fe95b4c389eae117d8a7c68d982055939f60a15ca0d01ef77
SHA51203b87bc7558e7502f325f2c46abb8d5ca17ac8077f13896ae6a305865f7965cfcf6b07cc236d20772691599f35c9602fdce3714a835a23fa8316340982bb8f67
-
Filesize
287B
MD5fa761cf8bddf680783f85e65f96418b2
SHA1520fcaad5d4f332401db69d1cc8040e814d2040a
SHA256367136f8e8b6d1078e92f4aebb33d6e51b2c2ce5427521852c27fed645745641
SHA51215e282857190c14e25438792d0fb7635fe9f00d8542c86101de048ccbc1bedadd5c4aad545d4c0a2785045a92c69f10c4f2a6e1b03429d62e5041f11cc9395ea
-
Filesize
16KB
MD537c28dd5c1e185c5cded257ad6c91c03
SHA13f84157f5bbfeebd135220130a8b0bd616017545
SHA2561e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b
SHA512f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41
-
Filesize
16KB
MD537c28dd5c1e185c5cded257ad6c91c03
SHA13f84157f5bbfeebd135220130a8b0bd616017545
SHA2561e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b
SHA512f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41
-
Filesize
16KB
MD537c28dd5c1e185c5cded257ad6c91c03
SHA13f84157f5bbfeebd135220130a8b0bd616017545
SHA2561e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b
SHA512f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41
-
Filesize
16KB
MD537c28dd5c1e185c5cded257ad6c91c03
SHA13f84157f5bbfeebd135220130a8b0bd616017545
SHA2561e2813f4a23f085eb4812095a26d592902cda2582e190e162c3f7dc3825c5c1b
SHA512f7cab8fc08ff970577b6a1b79743fbedb53eb4318394f6e0c54efc575c709d55b74d33c3bf7e0b7ad5c1b625a384538ee1434caf460eb158e5352efc08ed3b41
-
Filesize
45KB
MD5020891f9564e88267b002a4731429b4b
SHA1154b6231dc8866917a633cb02814047df7b21df3
SHA256bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1
SHA51247cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55
-
Filesize
45KB
MD5020891f9564e88267b002a4731429b4b
SHA1154b6231dc8866917a633cb02814047df7b21df3
SHA256bd10ca593172763d41b09f033ad4c90fc5cb243fbbb9d7d15925839ec16c16d1
SHA51247cd5b3e2d45f12e686e0686f52018fdce0bfa696a200e6f8b70c9023f3b9b1005c80b86bd8afa8f1ff301d957f9b0b8b8963b819e62f82bd95558c8ebd76f55
-
Filesize
13KB
MD53c3441990e0bf0eada3a93de7bb6b829
SHA11642694577d033cd73c0348b8754ce5403dc6530
SHA256852e1896be3f1be4483c058c94c179cbf2ffeea8d8d7b574ee54934950330121
SHA5120c4218b51f61fffb148d28f858b087fa07fe561b54b3988f379339f8ce6649fad36fff3c3f620e23efda213ce5475b0d823f157dd4e47b30226fb078563165b0
-
Filesize
13KB
MD53c3441990e0bf0eada3a93de7bb6b829
SHA11642694577d033cd73c0348b8754ce5403dc6530
SHA256852e1896be3f1be4483c058c94c179cbf2ffeea8d8d7b574ee54934950330121
SHA5120c4218b51f61fffb148d28f858b087fa07fe561b54b3988f379339f8ce6649fad36fff3c3f620e23efda213ce5475b0d823f157dd4e47b30226fb078563165b0
-
Filesize
10KB
MD58bf32bb81490a0c0428ff8b6f59ee042
SHA1959550372bfb3e254057c750bf858df375e8848e
SHA256f48fedceac21e1b76871f30d84786d2bc3c6de854d0d58ea3f6a53f6f16a03db
SHA5129caeefa2a2d275983b29a8fc454e3fa140b0217533d9102f722381bbf3d6a76db708de7d4da3c6ec1687c9896752e8c5137276ee2db0b0eaa903bb9dde8b6b48
-
Filesize
10KB
MD58bf32bb81490a0c0428ff8b6f59ee042
SHA1959550372bfb3e254057c750bf858df375e8848e
SHA256f48fedceac21e1b76871f30d84786d2bc3c6de854d0d58ea3f6a53f6f16a03db
SHA5129caeefa2a2d275983b29a8fc454e3fa140b0217533d9102f722381bbf3d6a76db708de7d4da3c6ec1687c9896752e8c5137276ee2db0b0eaa903bb9dde8b6b48