Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe
Resource
win10v2004-20220812-en
General
-
Target
ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe
-
Size
47KB
-
MD5
74665cd8729e247e2383a7cc73fce50b
-
SHA1
c3f3661a179864400232a523fc662cc48e54001b
-
SHA256
ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198
-
SHA512
6aff83719af9147b8f14bf3a3757f2754006f2d8125c2d66d2a8adef1ea177dc125e1e02d598774a8b0e3d9d1f0a5392cefeae86da49d7a2adfc8c6939d4af0d
-
SSDEEP
768:rE1kciNPyxvDNwtQqrmIGAqvR9E59N3mUfjEK1nIhC2vYM1MAa:r4kciNQB6QqrbqJ+91j/1vX0Mx
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\dao.ico ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.4462.com/?yya" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.4462.com/?yya" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe -
Modifies registry class 30 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "1" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\1 = "20221001" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "0" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.4462.com/?yya" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\cdafile2 = "2236" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5040 wrote to memory of 960 5040 ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe 82 PID 5040 wrote to memory of 960 5040 ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe 82 PID 5040 wrote to memory of 960 5040 ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe"C:\Users\Admin\AppData\Local\Temp\ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exeC:\Users\Admin\AppData\Local\Temp\ac7aa716ad3bb5d3f6117203cbaefdf8b7163c77ad6d5ba3ff867248b2edf198.exe2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:960
-