Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe
Resource
win10v2004-20220812-en
General
-
Target
9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe
-
Size
45KB
-
MD5
0711469624bbe084188bbf25dc6e445a
-
SHA1
843ef823fb6aeea214e2cf89c04a02afa98f44ad
-
SHA256
9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24
-
SHA512
88a685fa08060b0507ea43bd842e6e2129c8808f68735497246b8d22e908d5ef9e869279c6ce7df683ffac1785d19c92f217e1cd8767fce0be504d8642cfee37
-
SSDEEP
768:ywTukTPTBKhmGjam9HczJqoBRV+CsGlsdnBqhmef1hXLssk4fBf0YU7sw8X5:yKNTPmTczJZbXPsdVI1lLh1Ys3
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\dao.ico 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TYPEDURLS 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Window Title = "Microsoft Internet Explorer" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.ccc7.com" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.ccc7.com" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Pz 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "0" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.ccc7.com" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "1" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\1 = "20221028" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Pz\5 = "51" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1056 1324 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe 27 PID 1324 wrote to memory of 1056 1324 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe 27 PID 1324 wrote to memory of 1056 1324 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe 27 PID 1324 wrote to memory of 1056 1324 9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe"C:\Users\Admin\AppData\Local\Temp\9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exeC:\Users\Admin\AppData\Local\Temp\9f5e2112886329a4283fb57fb21b2fe733f654def2129a466fbd4a792b215e24.exe2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1056
-