Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe
Resource
win7-20220812-en
General
-
Target
513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe
-
Size
301KB
-
MD5
77d0ce0683aa2f27c161f1c1c3ac87f4
-
SHA1
f9c6f8db507e5ae9e7ee3bce6682d2310b31b7da
-
SHA256
513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4
-
SHA512
1d3267aaa1e84038c2b833dec662aaac272709985bf0b120dd66606eb299bba9ea95940d6b51eedbf3f14f011ce6f6c69fcc37fd3efc80f1ecd36efa5fb9401c
-
SSDEEP
6144:NCjVktZuPRDf+cxRPxEYhBHStiVuU9r8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PA:NCjutZu5Dm27HStVMr8wYbF0wp3kskcX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1360 SteepleContortion.exe 608 SteepleContortion.exe -
Loads dropped DLL 4 IoCs
pid Process 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F} regsvr32.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\VandalizePreside\TaperImpose.exe SteepleContortion.exe File opened for modification C:\Program Files\PageantIntricacy\PageantCaulk.exe SteepleContortion.exe File created C:\Program Files\PageantIntricacy\PageantCaulk.exe SteepleContortion.exe File created C:\Program Files\VandalizePreside\TaperImpose.exe SteepleContortion.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ZAYUOZBIDUJF.dll 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ = "Ixunlei" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\CLSID\ = "{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\ = "{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\ProgID\ = "Thunder.xunlei.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\InprocServer32\ = "C:\\Windows\\ZAYUOZBIDUJF.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ = "Ixunlei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CLSID\ = "{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\TypeLib\ = "{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\ = "Thunder 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\HELPDIR\ = "C:\\Windows" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\ = "xunlei Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\ = "xunlei Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\0\win32\ = "C:\\Windows\\ZAYUOZBIDUJF.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CurVer\ = "Thunder.xunlei.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\VersionIndependentProgID\ = "Thunder.xunlei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\ = "{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\ = "xunlei Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei regsvr32.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1360 SteepleContortion.exe 1360 SteepleContortion.exe 608 SteepleContortion.exe 608 SteepleContortion.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1696 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 28 PID 1960 wrote to memory of 1696 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 28 PID 1960 wrote to memory of 1696 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 28 PID 1960 wrote to memory of 1696 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 28 PID 1960 wrote to memory of 1696 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 28 PID 1960 wrote to memory of 1696 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 28 PID 1960 wrote to memory of 1696 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 28 PID 1960 wrote to memory of 1360 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 29 PID 1960 wrote to memory of 1360 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 29 PID 1960 wrote to memory of 1360 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 29 PID 1960 wrote to memory of 1360 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 29 PID 1960 wrote to memory of 608 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 30 PID 1960 wrote to memory of 608 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 30 PID 1960 wrote to memory of 608 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 30 PID 1960 wrote to memory of 608 1960 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe"C:\Users\Admin\AppData\Local\Temp\513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\ZAYUOZBIDUJF.dll"2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe"C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exeC:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:608
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
333KB
MD5b97630aa0bfe1420c162a253610d170a
SHA116c9ea06288ab5948612d2dcb28be2df719dda35
SHA256d9ecd3a1bcabe58164820a4dc28277652ac2f5f6efeff6ab46cf8d3b88a37b65
SHA5126dd5296f88d6fadb59b1722a92e716a4135bb6f37b1b9ac31b884ff1f9d8c4ebc8d96914e68f67074254d24fc8a4cbaaf1ce5fb9980875d77a8173da49189ec2
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8