Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe
-
Size
164KB
-
MD5
0c952e5bbd93aadeefbed649a7cc549d
-
SHA1
8518c7ee7c3d8e0c6678314f203ec6b68391dc97
-
SHA256
7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398
-
SHA512
3c50d2b90c98eeab5dfdfb99c4eb2091642decabfa1fefb6e6e8c62c368da03c679c7eb81b64088ff119b445011cd0843db736343093866167567c1bc61a3594
-
SSDEEP
3072:RmjwiHtyQm2ljvT7tiV5UH+mgoX3cHYl0X:R0wEyijiQHDHQ
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\dao.ico 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.on86.com/?581" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.on86.com/?581" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe -
Modifies registry class 53 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\dao.ico" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.on86.com/?581" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\Attributes = "0" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "1" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideFolderVerbs 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\cdafile2 = "51330" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.on86.com/?581" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ = "ÍøÖ·µ¼º½" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\WantsParseDisplayName 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideOnDesktopPerUser 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\1 = "20221106" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "0" 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688} 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1656 2204 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe 79 PID 2204 wrote to memory of 1656 2204 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe 79 PID 2204 wrote to memory of 1656 2204 7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe"C:\Users\Admin\AppData\Local\Temp\7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exeC:\Users\Admin\AppData\Local\Temp\7c38af2e29732759982e115a2a971ee95efa8cd954b6615a2ef92268e8449398.exe2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1656
-