Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
254s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe
Resource
win10v2004-20221111-en
General
-
Target
fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe
-
Size
482KB
-
MD5
259316770627da55f2dc5c79eefaf5d2
-
SHA1
41f9ac47683d119bd3807b684800531e0f3a1119
-
SHA256
fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d
-
SHA512
d1e4639ef7ad282f7c111d3a783445fb685e2f553b0833b4d4502c9d8b5dfc8d585093804ea0df51a03b116d03021a5d8050baa839c7fed6360d417f242a8709
-
SSDEEP
12288:yQDzWQSRnQ2QcKe86VovGiI/Z/UwWTRuqcMBazK:yICdecr8TI/ZTqcMBL
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies registry class 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cha\ = "ChatFile" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\DefaultIcon fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application\ = "zlip" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec\ = "%1" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe\"" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\EditFlags = 02000000 fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Application fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application\ = "zlip" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Topic fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\ifexec fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Topic\ = "Connect" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ = "%1" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\Software\Classes\irc\Shell\open\command fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ = "%1" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic\ = "Connect" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe\"" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ifexec\ = "%1" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\ = "Chat File" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\ = "URL:IRC Protocol" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe\" -noconnect" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\Software\Classes\irc fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\irc\URL Protocol fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cha fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.chat fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.chat\ = "ChatFile" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe\" -noconnect" fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1632 fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe 1632 fe19bdab9992471d86c858eaa3eaf7b3f9623030ffcf54b475594377ea575d1d.exe