Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe
Resource
win10v2004-20220901-en
General
-
Target
0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe
-
Size
52KB
-
MD5
35f4e745d23b7ecf18ed926b4e241964
-
SHA1
fa40594d119a914149a1804daee84a4cc9455e92
-
SHA256
0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369
-
SHA512
e14a7e57a416cb8a25dd335734b7ecfbab997846e11f40053a76681d76025473f8de0bdfd491bedcc2d273bed1a3005b74d30fb2e3e34948eb7eaa4e62757240
-
SSDEEP
1536:26sVp/oXlXm7gVT1F9xwLOCvnouy8imKciYUA:26E+XgSqOC/out5iK
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\7085253.TMP 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\realteck\geoidv.pif 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe File opened for modification C:\Program Files (x86)\Common Files\realteck\geoidv.pif 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32\ = "C:\\Windows\\SysWow64\\7085253.TMP" 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe Token: SeDebugPrivilege 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1992 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 27 PID 2024 wrote to memory of 1992 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 27 PID 2024 wrote to memory of 1992 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 27 PID 2024 wrote to memory of 1992 2024 0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe 27 PID 1352 wrote to memory of 580 1352 explorer.exe 29 PID 1352 wrote to memory of 580 1352 explorer.exe 29 PID 1352 wrote to memory of 580 1352 explorer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe"C:\Users\Admin\AppData\Local\Temp\0377b7988a0b8ec33cb8d95d70bd0e4f28df9b80741ba7a086fe9d24e93cc369.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:1992
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\system32\ctfmon.exectfmon.exe2⤵PID:580
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.2MB
MD56d7dc40724cd21cc7537ad1e7dab203a
SHA10ba065517825d40e164beb639274e6b6402d89e4
SHA256bedc7bdb8e804f16e4d87e2e5f8f575d8d578fbe87026c63441c0be006feda98
SHA51284b795c345d9b19de35c5945311625bdf6a370e28be986b4d75e44cd7f2c9d1a06f3096c06dab7f3472ac4fde3453676a30d65215e68d0d87fa7954381c0f842