Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    77s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2022, 09:42

General

  • Target

    HashTab-V6.3 完美汉化版/启用HashTab.bat

  • Size

    1KB

  • MD5

    9982f1f47c30503dfc631747cbe02e54

  • SHA1

    487e176d8690c3ec667b568bad6de13479c60044

  • SHA256

    ba2390f57c373aff66370b62fcaf6f3ceda978b52e76c121e50ab814d1a5d46f

  • SHA512

    76ea632c532cbc6b7078665dc91b79977bb11e5b6272c2d860ec47881c98cefb056249d3a0bf8e1a325843e8d223a2af3f6b12d976bb94c518b8b3a68ca46a69

Score
8/10

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 12 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HashTab-V6.3 完美汉化版\启用HashTab.bat"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\system32\reg.exe
      REG.exe query "HKU\S-1-5-19"
      2⤵
        PID:4204
      • C:\Windows\system32\regsvr32.exe
        regsvr32 /s "C:\Windows\System32\HashTab64.dll"
        2⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Modifies registry class
        PID:4036
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\CRC32" /v "Enabled" /d 0x00000001 /t REG_DWORD /f
        2⤵
          PID:4108
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\MD5" /v "Enabled" /d 0x00000001 /t REG_DWORD /f
          2⤵
            PID:4240
          • C:\Windows\system32\reg.exe
            reg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\SHA-1" /v "Enabled" /d 0x00000001 /t REG_DWORD /f
            2⤵
              PID:1952

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\System32\HashTab64.dll

            Filesize

            1.2MB

            MD5

            08cf369a6a98a4b36b04cc720d4ba2cd

            SHA1

            f5a579215cd7428c960066cf0125f912ba7d7d42

            SHA256

            c4b1a0bd0d7a1648e95c4cddd854cf63b1ffe0d6b17ceeaeb04c73ac8759d39e

            SHA512

            12c6ebae3f84435836a17de5eef96b7587c0b88e828349be45f6fa69cfc60a2200c8073ca22a6537d8864b73669ae581910c0c108010fe169aff73eec3974198

          • C:\Windows\System32\HashTab64.dll

            Filesize

            1.2MB

            MD5

            08cf369a6a98a4b36b04cc720d4ba2cd

            SHA1

            f5a579215cd7428c960066cf0125f912ba7d7d42

            SHA256

            c4b1a0bd0d7a1648e95c4cddd854cf63b1ffe0d6b17ceeaeb04c73ac8759d39e

            SHA512

            12c6ebae3f84435836a17de5eef96b7587c0b88e828349be45f6fa69cfc60a2200c8073ca22a6537d8864b73669ae581910c0c108010fe169aff73eec3974198