Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
HashTab-V6...32.dll
windows7-x64
1HashTab-V6...32.dll
windows10-2004-x64
1HashTab-V6...64.dll
windows7-x64
8HashTab-V6...64.dll
windows10-2004-x64
8HashTab-V6...ab.bat
windows7-x64
8HashTab-V6...ab.bat
windows10-2004-x64
8HashTab-V6...ab.bat
windows7-x64
8HashTab-V6...ab.bat
windows10-2004-x64
8Analysis
-
max time kernel
77s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2022, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
HashTab-V6.3 完美汉化版/HashTab32.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HashTab-V6.3 完美汉化版/HashTab32.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
HashTab-V6.3 完美汉化版/HashTab64.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
HashTab-V6.3 完美汉化版/HashTab64.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
HashTab-V6.3 完美汉化版/卸载HashTab.bat
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
HashTab-V6.3 完美汉化版/卸载HashTab.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
HashTab-V6.3 完美汉化版/启用HashTab.bat
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
HashTab-V6.3 完美汉化版/启用HashTab.bat
Resource
win10v2004-20220812-en
General
-
Target
HashTab-V6.3 完美汉化版/启用HashTab.bat
-
Size
1KB
-
MD5
9982f1f47c30503dfc631747cbe02e54
-
SHA1
487e176d8690c3ec667b568bad6de13479c60044
-
SHA256
ba2390f57c373aff66370b62fcaf6f3ceda978b52e76c121e50ab814d1a5d46f
-
SHA512
76ea632c532cbc6b7078665dc91b79977bb11e5b6272c2d860ec47881c98cefb056249d3a0bf8e1a325843e8d223a2af3f6b12d976bb94c518b8b3a68ca46a69
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32 regsvr32.exe -
Loads dropped DLL 1 IoCs
pid Process 4036 regsvr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\HashTab64.dll cmd.exe File opened for modification C:\Windows\System32\HashTab64.dll cmd.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\VersionIndependentProgID\ = "HashTab.DropTargetImpl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\HashTab regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage.1\ = "HashPage Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ = "IDropTargetImpl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\ProgID\ = "HashTab.DropTargetImpl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{0A3C1C8E-5829-4CFD-B1CC-475DB010B883} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\InprocServer32\ = "C:\\Windows\\System32\\HashTab64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{77E80876-D470-4EC2-9EA6-FE8CD145A475}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ = "IHashMenu" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5FCF1002-1131-4C88-B982-1B5055C7C945} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\CurVer\ = "HashTab.DropTargetImpl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl\CLSID\ = "{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E7435935-AAEF-4CE2-AD7C-66D46C192A0F}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A56567E-A333-4843-B6E1-C3A262E41D8C}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1BC2DEA9-DCDB-4961-8BDB-107767D135A9}\ = "IDropTargetImpl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA10CE2A-5097-4D39-96A8-1E64ADFA9096}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\HashTab.DLL\AppID = "{0A3C1C8E-5829-4CFD-B1CC-475DB010B883}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.HashPage\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FD14B7C-A581-4F66-84C1-67C4CE14BBCA}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3D7DD5D-510B-477C-9521-2BCBCC91762C}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB9BCA6C-181C-44CC-ACD2-161FF3C6E592}\TypeLib\ = "{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HashTab.DropTargetImpl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1F9B20F0-0AA5-4EEB-B5ED-FADA0C41D073}\1.0\ = "HashTab 1.0 Type Library" regsvr32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4152 wrote to memory of 4204 4152 cmd.exe 81 PID 4152 wrote to memory of 4204 4152 cmd.exe 81 PID 4152 wrote to memory of 4036 4152 cmd.exe 82 PID 4152 wrote to memory of 4036 4152 cmd.exe 82 PID 4152 wrote to memory of 4108 4152 cmd.exe 83 PID 4152 wrote to memory of 4108 4152 cmd.exe 83 PID 4152 wrote to memory of 4240 4152 cmd.exe 84 PID 4152 wrote to memory of 4240 4152 cmd.exe 84 PID 4152 wrote to memory of 1952 4152 cmd.exe 85 PID 4152 wrote to memory of 1952 4152 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HashTab-V6.3 完美汉化版\启用HashTab.bat"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\system32\reg.exeREG.exe query "HKU\S-1-5-19"2⤵PID:4204
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Windows\System32\HashTab64.dll"2⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4036
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\CRC32" /v "Enabled" /d 0x00000001 /t REG_DWORD /f2⤵PID:4108
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\MD5" /v "Enabled" /d 0x00000001 /t REG_DWORD /f2⤵PID:4240
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\HashTab\Algorithms\SHA-1" /v "Enabled" /d 0x00000001 /t REG_DWORD /f2⤵PID:1952
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD508cf369a6a98a4b36b04cc720d4ba2cd
SHA1f5a579215cd7428c960066cf0125f912ba7d7d42
SHA256c4b1a0bd0d7a1648e95c4cddd854cf63b1ffe0d6b17ceeaeb04c73ac8759d39e
SHA51212c6ebae3f84435836a17de5eef96b7587c0b88e828349be45f6fa69cfc60a2200c8073ca22a6537d8864b73669ae581910c0c108010fe169aff73eec3974198
-
Filesize
1.2MB
MD508cf369a6a98a4b36b04cc720d4ba2cd
SHA1f5a579215cd7428c960066cf0125f912ba7d7d42
SHA256c4b1a0bd0d7a1648e95c4cddd854cf63b1ffe0d6b17ceeaeb04c73ac8759d39e
SHA51212c6ebae3f84435836a17de5eef96b7587c0b88e828349be45f6fa69cfc60a2200c8073ca22a6537d8864b73669ae581910c0c108010fe169aff73eec3974198