Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
Resource
win10v2004-20220812-en
General
-
Target
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
-
Size
172KB
-
MD5
3d83c8e629e7a271448568b4edf53627
-
SHA1
28f376dbfb54f68fa87dbb20255574cc1fa9f63e
-
SHA256
b5281c0c00bdc0ebde811cb4ae7458eefd4c4add80eb4d8ef3e4a90280b06133
-
SHA512
b68333badf1c5147e11cd1c0299732eda31268bbc690521beb1304370b007dc9cc786033d0c6e332d42d2ac90699c49e1fdd832a603b03b7f26d0fe36092fbb0
-
SSDEEP
3072:Aac0KMWBexMF+4eXsy3cvf5ftCC6ofPBPK5dTLiwCOv8G7PAPplKrrz:AbKXxI+4GZcXgohPKLF8Coh
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1100 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhohjter.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\dhohjter.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1672 set thread context of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RECHNU~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\DefaultIcon rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RECHNU~1.EXE \"%1\"" rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RECHNU~1.EXE,0" rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\print rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\printto\command rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\ = "Tif Document" rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\open\command rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\print\command rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\open rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RECHNU~1.EXE /p \"%1\"" rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Tif.Document\shell\printto rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Token: SeDebugPrivilege 1260 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 1672 wrote to memory of 2020 1672 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 27 PID 2020 wrote to memory of 1100 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 28 PID 2020 wrote to memory of 1100 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 28 PID 2020 wrote to memory of 1100 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 28 PID 2020 wrote to memory of 1100 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 28 PID 2020 wrote to memory of 1260 2020 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 14 PID 1260 wrote to memory of 1132 1260 Explorer.EXE 13 PID 1260 wrote to memory of 1224 1260 Explorer.EXE 15 PID 1260 wrote to memory of 1100 1260 Explorer.EXE 28
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeC:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2003~1.BAT"4⤵
- Deletes itself
PID:1100
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1224
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD5b7f15a94051ea4a92966be866a1bf649
SHA1f14e4649523855d1586f0fd7c382285cc7c8b8f0
SHA256acaf1ae655cca706200f301d83592eb34ebf91178bda7569338c77f21e37c03d
SHA512cb077ced4d77764125341551e8394cbb5b60846b963b4bf563039a05beb490484bb53f0469e67c76309d9f1899ea86dd33804b2dbd191ee481dee3dca4bc7f8f