Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 06:35
Behavioral task
behavioral1
Sample
956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe
Resource
win10v2004-20220901-en
General
-
Target
956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe
-
Size
541KB
-
MD5
1d7f62d28cb0885bef466efde20583f3
-
SHA1
a462cb6ecbd5f6a25033b4db52f51340472fd241
-
SHA256
956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d
-
SHA512
acc5e4332380010fa5f417acafa548840b74295a122105f3211f565c79c7cd50a645c3b781f16f28166380a32e41a2f9d34a0a3b52faa800943c2214345d8a16
-
SSDEEP
12288:ADaq927uCSbyjNfh7NC/E5l2F+7p64ozoCeaUUo2VWe:ADz2yyjT7N+R+7IjeaUUo28e
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1716-55-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral1/memory/1716-67-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral1/files/0x0006000000014ab1-70.dat upx -
Deletes itself 1 IoCs
pid Process 1800 cmd.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\TaoBao\ÌÔ±¦.ico 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe File created C:\Program Files (x86)\Common Files\TaoBao\СÓÎÏ·.ico 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\RtkSYUdp.exe 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\software\Wow6432Node\microsoft\internet explorer\version Vector 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe -
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ = "InternetShortcut" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\PersistentHandler regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{00021500-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\LocalizedString = "@shdoclc.dll,-880" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{FBF23B80-E3F0-101B-8488-00AA003E56F8} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{00021500-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellNew\Command = "rundll32.exe appwiz.cpl,NewLinkHere %1" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open\ = "´ò¿ªÖ÷Ò³(&H)" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{FBF23B80-E3F0-101B-8488-00AA003E56F8}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open\Command\ = "IEXPLORE.EXE %w%w%w.93%119%15.%c%o%m" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellNew regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open\Command regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\ShellFolder\Attributes = "0" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214F9-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ\ = "ÊôÐÔ(&R)" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\ShellFolder\ regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214EE-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ = "lnkfile" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\InfoTip = "@shdoclc.dll,-881" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\DefaultIcon regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\DefaultIcon\ = "shdoclc.dll,-190" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\ShellFolder regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\PersistentHandler\ = "{5e941d80-bf96-11cd-b579-08002b30bfeb}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214EE-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214F9-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regedit.exe -
Runs regedit.exe 3 IoCs
pid Process 556 regedit.exe 872 regedit.exe 396 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1716 wrote to memory of 556 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 28 PID 1716 wrote to memory of 556 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 28 PID 1716 wrote to memory of 556 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 28 PID 1716 wrote to memory of 556 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 28 PID 1716 wrote to memory of 872 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 29 PID 1716 wrote to memory of 872 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 29 PID 1716 wrote to memory of 872 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 29 PID 1716 wrote to memory of 872 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 29 PID 1716 wrote to memory of 1304 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 30 PID 1716 wrote to memory of 1304 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 30 PID 1716 wrote to memory of 1304 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 30 PID 1716 wrote to memory of 1304 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 30 PID 1716 wrote to memory of 396 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 32 PID 1716 wrote to memory of 396 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 32 PID 1716 wrote to memory of 396 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 32 PID 1716 wrote to memory of 396 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 32 PID 1716 wrote to memory of 1800 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 33 PID 1716 wrote to memory of 1800 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 33 PID 1716 wrote to memory of 1800 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 33 PID 1716 wrote to memory of 1800 1716 956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe 33 PID 1800 wrote to memory of 1368 1800 cmd.exe 35 PID 1800 wrote to memory of 1368 1800 cmd.exe 35 PID 1800 wrote to memory of 1368 1800 cmd.exe 35 PID 1800 wrote to memory of 1368 1800 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe"C:\Users\Admin\AppData\Local\Temp\956bc669fb78d56a792596c08e8243c196aaad7779b2fbe7fd435a90d7e6251d.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\$rar10656.tmp2⤵
- Modifies registry class
- Runs regedit.exe
PID:556
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\$10943.tmp2⤵
- Runs regedit.exe
PID:872
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$edbs.bat2⤵PID:1304
-
-
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /s C:\Users\Admin\AppData\Local\Temp\okhhhik.tmp2⤵
- Modifies registry class
- Runs regedit.exe
PID:396
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f3⤵PID:1368
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
665B
MD5f1a978e634978a65312d40a14c89c0c8
SHA137abbedff6a56142242d52d1847c8b644f70f8b0
SHA2567bc6406a489989514df4f1c0d6cfd05684fa638a7b31e9cc7e8fa618e77d4d3a
SHA5121aeccc3b6d3d54baf623e2dd435b020325bac285f1717881836a31184fa8626ee0721cf4ac2e61f542c64b88fe3119c401cc1583be519201581703435666c9a7
-
Filesize
59B
MD50cf180f20e716094bef34db0f1a39a04
SHA1f8e9da5d8eaf347b240a77c6a9c4f494d4fc351b
SHA2562a72298ec1d957d1d225aec50a4e6e32c5dec2f2645f25e580304e5c7ae5bb26
SHA512a471fee35dfc685effb46fcc37d47d7210fad3fdba7cb5342b13e11f95ae7690e4053b3399bca6da7546015a479ce55a301c6934be8bab7ec9eae5aece8bdb3b
-
Filesize
1KB
MD5f9ce5c8a3059991babf4084151caa492
SHA126567f89a885b0e69f24309c3e5c58e8e938f841
SHA256e82c214f33cad1b25146758e22fd887b15f63b1a7a8d716b358c50dc5c3d4e96
SHA512cce48827588aa5968453a8a69baeab8435083dca1d625d079b01d4f9292c7bcb85ab1217f1cf96ea301eef49b7a96a76b58413d4496f1c35e234df7c7e5c9750
-
Filesize
142B
MD51722b85f05faa97e09cc1d98002d0711
SHA10a2ec5d60f6c8af838fc004e8fbb0b436437887f
SHA2562c428a167d8dabe9b4e4e821f5d56333962208ef44bc0becbf9c968f1e583e21
SHA51240393e3b6f958a2b0303810ba3653f55b18ff22439df78487752c92cbe0a510120b2a078b31805980ae2ceaa4465674bfc2ce03803988481fd633e2b9c3ca3b8
-
Filesize
3KB
MD525db315b7c4e03440fc39a45d0e696f4
SHA1e676a65ddced682543871402c65745615866813b
SHA256afebbcbfd45e044083133fd2f575f9cee59dbff403ae376b2d2307a89b97a26c
SHA512d10afe733da4f6c33e2859078ca307e40cf15c0e2ddde9e48b8cb3962491cc73e6b47d2fb98c56d233bef268cf1d45ac68d5835885a8b5395ee4b0c6dd0ad3d4
-
Filesize
30KB
MD5d0cd586c5c857850a188e778b971f25a
SHA13f584fd89e41151c389b4701d876d2bdd2885fc2
SHA2562f6cd2ed9806a09fecce1f96cd5b3f77fc0339ddbbb4c31aab25e85fd3f268eb
SHA512995f539c7163e0e49c7cc4687dd29dac4ac88501410d8c9935f99d993b14bf5fe349cdcdc9f61d4f308c280536b54f54ae7d041565c73a2340881f68e7b2c41c