Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2022, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe
Resource
win10v2004-20220812-en
General
-
Target
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe
-
Size
464KB
-
MD5
fdf8218be046b3de1f56632d723b3990
-
SHA1
3987e62a0f46eac4b30c3fbec4e78c4419e85b3b
-
SHA256
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334
-
SHA512
33d944c061d1e05b52c8bf1fd2c88434bc9f908225f0c78ad311bc03c699bd1dc1ea3c4591d4ca7c37dd12fcbc44b9c3c45c760d220d717ad52b5f78142cfd0b
-
SSDEEP
6144:yiNjjdOCJnUNKMEPDGeoo1HyisWW4g0QTxbGctE6Jm20tdVgWwAidpNCgrBF:TjjwULQoN84XQT08JoVgWwAkAQ
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0006000000022e23-133.dat aspack_v212_v242 behavioral2/files/0x0006000000022e23-134.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2740 dwm.exe -
Loads dropped DLL 1 IoCs
pid Process 2228 Regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GGHMUM.EXE = "C:\\Program Files (x86)\\svchost.exe" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\H: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\L: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\P: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\Q: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\R: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\S: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\U: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\I: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\K: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\O: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\E: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\F: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\N: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\V: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\G: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\J: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\M: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\VCG.EXE 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File created C:\Windows\SysWOW64\Ms7002.dll 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\NQDDTJ.EXE 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened for modification C:\Program Files (x86)\NQDDTJ.EXE 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File created C:\Program Files (x86)\svchost.exe 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe -
Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile\qp7002 = "C:\\Windows\\SysWow64\\VCG.EXE" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ = "C:\\Windows\\SysWow64\\Ms7002.dll" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\ = "MaiHook7002" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid\ = "{7CD4138D-4147-420B-9749-00A13B526785}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\odt\\VCG.EXE %1" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID\ = "Ms7002.ShellExecuteHook" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Program Files (x86)\\NQDDTJ.EXE \"%1\"" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\odt\\VCG.EXE \"%1\"" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files (x86)\\NQDDTJ.EXE %1" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ = "MaiHook7002" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile dwm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785} Regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2740 dwm.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3868 wrote to memory of 2228 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 82 PID 3868 wrote to memory of 2228 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 82 PID 3868 wrote to memory of 2228 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 82 PID 3868 wrote to memory of 2740 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 83 PID 3868 wrote to memory of 2740 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 83 PID 3868 wrote to memory of 2740 3868 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe"C:\Users\Admin\AppData\Local\Temp\7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe C:\Windows\system32\Ms7002.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2228
-
-
C:\odt\dwm.exeC:\odt\dwm.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2740
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5876a2a99b81968f5b26e3cbe12063d2b
SHA17afa8f33b691b2651b65eb07220cc2fda4b7537c
SHA256f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
SHA512ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1
-
Filesize
52KB
MD5876a2a99b81968f5b26e3cbe12063d2b
SHA17afa8f33b691b2651b65eb07220cc2fda4b7537c
SHA256f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
SHA512ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1
-
Filesize
464KB
MD5e6d0a46a168d154fd609edbe4c807179
SHA1ead21a872ad7a107035b0c29accbe23ec200a695
SHA25616f1753e1053ffeb4098ed619b90341f8f11e767647258fe626d14e4510d6c80
SHA512e9e9e6054b2f15efaef8c3ff4afcf23577911faf70238789c0172bb471c165cb8a3222d9a6a573cb69f30bd1d4a07291461f939debe37e80519754a8256ccae3
-
Filesize
464KB
MD5e6d0a46a168d154fd609edbe4c807179
SHA1ead21a872ad7a107035b0c29accbe23ec200a695
SHA25616f1753e1053ffeb4098ed619b90341f8f11e767647258fe626d14e4510d6c80
SHA512e9e9e6054b2f15efaef8c3ff4afcf23577911faf70238789c0172bb471c165cb8a3222d9a6a573cb69f30bd1d4a07291461f939debe37e80519754a8256ccae3