Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Resource
win7-20220812-en
General
-
Target
e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
-
Size
176KB
-
MD5
2ecf4a0cb843ef19bbf52adf1e8cff6c
-
SHA1
7e4b734860db8516b8c3c246a371ee8aab420cea
-
SHA256
e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6
-
SHA512
9ec62b125cc3b96f6f154734d97193077a38a6921687857c4d9b571b608e1610d6a5e0f08de4a50540955ee70be3d5928ec8f1df7424bb27206eb258504c4cb2
-
SSDEEP
3072:y8SBjlnc5OevGSXhuULpKwg2H+a63U57dbiLCNN1dR3:y/B5c5MSXhuU9KwG3UWLCNndZ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 736 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{32324134-3465-4325-6543-325435274523} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\altcmd\altcmd.inf e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File created C:\Program Files (x86)\altcmd\uninstall.bat e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File opened for modification C:\Program Files (x86)\altcmd\uninstall.bat e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File created C:\Program Files (x86)\altcmd\altcmd32.dll e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File opened for modification C:\Program Files (x86)\altcmd\altcmd32.dll e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File created C:\Program Files (x86)\altcmd\altcmd.inf e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ThreadingModel = "Apartment" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID\ = "{32324134-3465-4325-6543-325435274523}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\Programmable e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID\ = "{32324134-3465-4325-6543-325435274523}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID\ = "MsVCL1.BhoApp" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\ = "BhoApp Class" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\ = "BhoApp Class" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer\ = "MsVCL1.BhoApp.1" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID\ = "MsVCL1.BhoApp.1" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\ = "MsVCL1 1.0 Type Library" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\altcmd\\" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ = "BhoApp Class" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS\ = "0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 736 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 736 wrote to memory of 904 736 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe 27 PID 736 wrote to memory of 904 736 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe 27 PID 736 wrote to memory of 904 736 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe 27 PID 736 wrote to memory of 904 736 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe"C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\4E2.bat2⤵PID:904
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
294B
MD5a0baa2efdd8779569acd363bba8081ac
SHA15eead3814ca26f65f62c15b89f8117e6dbd2eedf
SHA2566002fb63acf6a46a8affdb3ee2e0a07402ee5a0b3b1a3d51996ba761d3dbd707
SHA512ab68e2026be9c49bff9f386641e78f6433354b29be982b7f0f5b143aa6fd47c85dc5bc500201b8483b47976af39a9f7a8afd9f0a8361e24710f115fac20573b9
-
Filesize
160KB
MD5968158bf7662cea9e0f5c89b97a81a12
SHA15eb4903d8cf6448b97c5f5f25e9e89351b53919f
SHA256c3131cdc0d4f9adf633b2e58b05730924f284fc8e51a7bf90151a7a075dc750f
SHA5123962378f0f76b1f4a1846bd957a1eaa10a3222bd8d26e44705845c5f395d2284e7af9045bf379ad23019e4a24a5313a31e5b1f139f80ff20d767dd9febe45744