Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 22:40
Static task
static1
Behavioral task
behavioral1
Sample
c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec.exe
Resource
win7-20220812-en
General
-
Target
c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec.exe
-
Size
2.1MB
-
MD5
304ad28c917650c85a7b7f6f0d4bd99a
-
SHA1
3482471db8ed8e9b1e6091d740354ebad8fc4cf3
-
SHA256
c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec
-
SHA512
b39e82d7afd45b8d1224ca2ba1a83c6a0bf2504b9270990e908b3e08929626a945885913994ee4ce0bde43bba700babc49a3daac455e563033ce74834ebf04b7
-
SSDEEP
49152:h1OsYYIGWkf6jd9YMhKKumq+4oAczj/i6jgvb7GvKSO:h1Obdd9YMhKgq+4fb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4280 Z1ppxx4RNBTdBAj.exe -
Loads dropped DLL 3 IoCs
pid Process 4280 Z1ppxx4RNBTdBAj.exe 4664 regsvr32.exe 1508 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} Z1ppxx4RNBTdBAj.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects Z1ppxx4RNBTdBAj.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} Z1ppxx4RNBTdBAj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ Z1ppxx4RNBTdBAj.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.x64.dll Z1ppxx4RNBTdBAj.exe File opened for modification C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.x64.dll Z1ppxx4RNBTdBAj.exe File created C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.dll Z1ppxx4RNBTdBAj.exe File opened for modification C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.dll Z1ppxx4RNBTdBAj.exe File created C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.tlb Z1ppxx4RNBTdBAj.exe File opened for modification C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.tlb Z1ppxx4RNBTdBAj.exe File created C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.dat Z1ppxx4RNBTdBAj.exe File opened for modification C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.dat Z1ppxx4RNBTdBAj.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3804 wrote to memory of 4280 3804 c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec.exe 84 PID 3804 wrote to memory of 4280 3804 c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec.exe 84 PID 3804 wrote to memory of 4280 3804 c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec.exe 84 PID 4280 wrote to memory of 4664 4280 Z1ppxx4RNBTdBAj.exe 85 PID 4280 wrote to memory of 4664 4280 Z1ppxx4RNBTdBAj.exe 85 PID 4280 wrote to memory of 4664 4280 Z1ppxx4RNBTdBAj.exe 85 PID 4664 wrote to memory of 1508 4664 regsvr32.exe 86 PID 4664 wrote to memory of 1508 4664 regsvr32.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec.exe"C:\Users\Admin\AppData\Local\Temp\c4f829d8b983b2998b0df6ee59e7926450dcdcdbd92d36bf1580fad9eda17fec.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\7zSE5D1.tmp\Z1ppxx4RNBTdBAj.exe.\Z1ppxx4RNBTdBAj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSAVe\bKhkDKj0i52grN.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:1508
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD500f639df580523b0c8925f92a33876ea
SHA1debe7d82d951e7d05cec47d4c7bbdd273249f18e
SHA2565d811f7544ef264686caf635bb5363e3de3b2b75e51b480edf1b7a1fde924abf
SHA51241c9e62a4696e5e648fabd404f38c743a48fbe24c16e8a74fc07429b83df4d5b9b3e120a0d33163c0470c164c597fa766d6354fa172eea0c553757e209faa636
-
Filesize
623KB
MD5103866fff4628ada4be6e5235b2ebf5d
SHA186ca018b33c7cdb953371ee1e290313b9a54a251
SHA256963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c
SHA5122a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6
-
Filesize
5KB
MD500f639df580523b0c8925f92a33876ea
SHA1debe7d82d951e7d05cec47d4c7bbdd273249f18e
SHA2565d811f7544ef264686caf635bb5363e3de3b2b75e51b480edf1b7a1fde924abf
SHA51241c9e62a4696e5e648fabd404f38c743a48fbe24c16e8a74fc07429b83df4d5b9b3e120a0d33163c0470c164c597fa766d6354fa172eea0c553757e209faa636
-
Filesize
629KB
MD5150107c0a55484355ce5881240cca669
SHA135d2f6723091fc4af5c4a00645b6b0f43efd4a06
SHA256c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e
SHA512eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04
-
Filesize
629KB
MD5150107c0a55484355ce5881240cca669
SHA135d2f6723091fc4af5c4a00645b6b0f43efd4a06
SHA256c422b33bee8c0b6664a7462093734aea98026ebf7cc9dc65589572213f576f0e
SHA512eb189951a9a89c54c8d7b3a9fcfb97777bd55088186814597ba13e9f985f846e313b5fcd1566de56060ef8cdfb815ed2a77f5c41c02d1c666c47691b1c0aba04
-
Filesize
623KB
MD5103866fff4628ada4be6e5235b2ebf5d
SHA186ca018b33c7cdb953371ee1e290313b9a54a251
SHA256963728f71b4ecee9380a18f5bbc6930256be6018a8087a9964f98ba3e17b7a7c
SHA5122a8f9ce8854bab77b801eb146934e267de3cca83727a8a7c13885b41c75a0b563fdd0cb1683f78057fc6833b22d9d14c5ef0d3707753293d59d4b61f7a9744c3
-
Filesize
3KB
MD53c920faafd032eeda08e4166860d4318
SHA126451ee3659c4a217f42ebd07f254679ab452f3a
SHA2563377d0af1044505271c64fc342e22a7a24b757e5471657f656ac743373e22857
SHA512327668001f94842eee3ff1dc44c70ddca5da3a0bb49aeea6b3162608b07496456e78bcb3de0462e5e375b349e813f13fd02e61b9e389b1d954cea2628c3c4a6e
-
Filesize
700KB
MD5401087ab67c6d917bf08d82f011d9eee
SHA1d13dbf241d214d6036f8c6276e0e305fc2ac2b8a
SHA256fada9f28483ab94341359011d5ab92a6fa2418d010aa3eb1c485c19db15e62f5
SHA5124d952fc0a2ef968997d62d901a731193105da2f4541abf4eb3e5c99e247edc7ffb15ae55a8d0e5d228ae704b0a7ff7dca24e14312f778896d834971e7f3d8af6