Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 14:42
Static task
static1
Behavioral task
behavioral1
Sample
0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe
Resource
win10v2004-20221111-en
General
-
Target
0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe
-
Size
113KB
-
MD5
398704187c4c26abbcbb3156488ccbd0
-
SHA1
89598608f85359d70dbf19504d31d8dfafda871f
-
SHA256
0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976
-
SHA512
7346c64151ddbec8df983bd31bd9ff997a7dba71f9ea69a2e3025cc72b73624a930d43e5584ce4492174903f74455c3108838ee3abad28be6bc93edf537f29a3
-
SSDEEP
768:jZKM11gG4ChfiPO0rfz0shcUypMC5/VKhZyg3iepFV2jp:gMDgG4ChfiPOefgsOUqQwgc
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Syssrc32 = "C:\\Windows\\Syssrc32.exe" 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fndfst32 = "C:\\Windows\\System\\fndfst32.exe" 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer Shell = "C:\\Windows\\System\\Explorer.exe" 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System applets = "C:\\Windows\\System\\applets.exe" 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\System\mplayerw.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File opened for modification C:\Windows\System\applets.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File opened for modification C:\Windows\System\fndfst32.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File created C:\Windows\System\Sysexp32.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File created C:\Windows\Syssrc32.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File created C:\Windows\System\Explorer.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File opened for modification C:\Windows\Syssrc32.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File opened for modification C:\Windows\System\Sysexp32.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File created C:\Windows\System\applets.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File created C:\Windows\System\fndfst32.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File opened for modification C:\Windows\System\Explorer.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File opened for modification C:\Windows\Help\intret.cnt 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File created C:\Windows\System\mplayerw.exe 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe File created C:\Windows\Help\intret.cnt 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1664 1844 WerFault.exe 27 -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\Explore = "%SystemRoot%\\SysWow64\\NOTEPAD.EXE %1" 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\System\\Sysexp32.exe %1" 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 1664 1844 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe 28 PID 1844 wrote to memory of 1664 1844 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe 28 PID 1844 wrote to memory of 1664 1844 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe 28 PID 1844 wrote to memory of 1664 1844 0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe"C:\Users\Admin\AppData\Local\Temp\0be28ea1c28b5c1d775aeee4566c5de827890d7b4de41d7e58bc36430aa19976.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 922⤵
- Program crash
PID:1664
-