Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
HashTab-V6...32.dll
windows7-x64
1HashTab-V6...32.dll
windows10-2004-x64
1HashTab-V6...64.dll
windows7-x64
8HashTab-V6...64.dll
windows10-2004-x64
8HashTab-V6...ab.bat
windows7-x64
8HashTab-V6...ab.bat
windows10-2004-x64
8HashTab-V6...ab.bat
windows7-x64
8HashTab-V6...ab.bat
windows10-2004-x64
8Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/11/2022, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
HashTab-V6.3 完美汉化版/HashTab32.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HashTab-V6.3 完美汉化版/HashTab32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
HashTab-V6.3 完美汉化版/HashTab64.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
HashTab-V6.3 完美汉化版/HashTab64.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
HashTab-V6.3 完美汉化版/卸载HashTab.bat
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
HashTab-V6.3 完美汉化版/卸载HashTab.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
HashTab-V6.3 完美汉化版/启用HashTab.bat
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
HashTab-V6.3 完美汉化版/启用HashTab.bat
Resource
win10v2004-20220812-en
General
-
Target
HashTab-V6.3 完美汉化版/启用HashTab.bat
-
Size
1KB
-
MD5
9982f1f47c30503dfc631747cbe02e54
-
SHA1
487e176d8690c3ec667b568bad6de13479c60044
-
SHA256
ba2390f57c373aff66370b62fcaf6f3ceda978b52e76c121e50ab814d1a5d46f
-
SHA512
76ea632c532cbc6b7078665dc91b79977bb11e5b6272c2d860ec47881c98cefb056249d3a0bf8e1a325843e8d223a2af3f6b12d976bb94c518b8b3a68ca46a69
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Loads dropped DLL 1 IoCs
pid Process 820 regsvr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\HashTab64.dll cmd.exe File opened for modification C:\Windows\System32\HashTab64.dll cmd.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\AppID = "{0A3C1C8E-5829-4CFD-B1CC-475DB010B883}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\ = "HashTab 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\HashTab.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ = "IReportProgress" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl.1\ = "DropTargetImpl Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ = "IHashMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\ = "IHashPage" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage\ = "HashPage Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\ = "Hasher Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ = "IHashMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\ = "DropTargetImpl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage\CLSID\ = "{8A56567E-A333-4843-B6E1-C3A262E41D8C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\HashTab.DLL\AppID = "{0A3C1C8E-5829-4CFD-B1CC-475DB010B883}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl.1\CLSID\ = "{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\AppID = "{0A3C1C8E-5829-4CFD-B1CC-475DB010B883}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\ = "ReportProgress Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\ = "DropTargetImpl Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage.1\CLSID\ = "{8A56567E-A333-4843-B6E1-C3A262E41D8C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ = "IDropTargetImpl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\ProgID\ = "HashTab.HashPage.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0A3C1C8E-5829-4CFD-B1CC-475DB010B883} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage\CurVer\ = "HashTab.HashPage.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\ = "IHasher" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ = "IDropTargetImpl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\VersionIndependentProgID regsvr32.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 820 regsvr32.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1188 1268 cmd.exe 28 PID 1268 wrote to memory of 1188 1268 cmd.exe 28 PID 1268 wrote to memory of 1188 1268 cmd.exe 28 PID 1268 wrote to memory of 820 1268 cmd.exe 29 PID 1268 wrote to memory of 820 1268 cmd.exe 29 PID 1268 wrote to memory of 820 1268 cmd.exe 29 PID 1268 wrote to memory of 820 1268 cmd.exe 29 PID 1268 wrote to memory of 820 1268 cmd.exe 29 PID 1268 wrote to memory of 1608 1268 cmd.exe 30 PID 1268 wrote to memory of 1608 1268 cmd.exe 30 PID 1268 wrote to memory of 1608 1268 cmd.exe 30 PID 1268 wrote to memory of 1780 1268 cmd.exe 31 PID 1268 wrote to memory of 1780 1268 cmd.exe 31 PID 1268 wrote to memory of 1780 1268 cmd.exe 31 PID 1268 wrote to memory of 1544 1268 cmd.exe 32 PID 1268 wrote to memory of 1544 1268 cmd.exe 32 PID 1268 wrote to memory of 1544 1268 cmd.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\HashTab-V6.3 完美汉化版\启用HashTab.bat"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\system32\reg.exeREG.exe query "HKU\S-1-5-19"2⤵PID:1188
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Windows\System32\HashTab64.dll"2⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:820
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\CRC32" /v "Enabled" /d 0x00000001 /t REG_DWORD /f2⤵PID:1608
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\MD5" /v "Enabled" /d 0x00000001 /t REG_DWORD /f2⤵PID:1780
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\SHA-1" /v "Enabled" /d 0x00000001 /t REG_DWORD /f2⤵PID:1544
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD508cf369a6a98a4b36b04cc720d4ba2cd
SHA1f5a579215cd7428c960066cf0125f912ba7d7d42
SHA256c4b1a0bd0d7a1648e95c4cddd854cf63b1ffe0d6b17ceeaeb04c73ac8759d39e
SHA51212c6ebae3f84435836a17de5eef96b7587c0b88e828349be45f6fa69cfc60a2200c8073ca22a6537d8864b73669ae581910c0c108010fe169aff73eec3974198
-
Filesize
1.2MB
MD508cf369a6a98a4b36b04cc720d4ba2cd
SHA1f5a579215cd7428c960066cf0125f912ba7d7d42
SHA256c4b1a0bd0d7a1648e95c4cddd854cf63b1ffe0d6b17ceeaeb04c73ac8759d39e
SHA51212c6ebae3f84435836a17de5eef96b7587c0b88e828349be45f6fa69cfc60a2200c8073ca22a6537d8864b73669ae581910c0c108010fe169aff73eec3974198