Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
Resource
win7-20220812-en
General
-
Target
e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe
-
Size
176KB
-
MD5
2ecf4a0cb843ef19bbf52adf1e8cff6c
-
SHA1
7e4b734860db8516b8c3c246a371ee8aab420cea
-
SHA256
e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6
-
SHA512
9ec62b125cc3b96f6f154734d97193077a38a6921687857c4d9b571b608e1610d6a5e0f08de4a50540955ee70be3d5928ec8f1df7424bb27206eb258504c4cb2
-
SSDEEP
3072:y8SBjlnc5OevGSXhuULpKwg2H+a63U57dbiLCNN1dR3:y/B5c5MSXhuU9KwG3UWLCNndZ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3792 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{32324134-3465-4325-6543-325435274523} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\altcmd\altcmd.inf e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File opened for modification C:\Program Files (x86)\altcmd\altcmd.inf e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File created C:\Program Files (x86)\altcmd\uninstall.bat e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File opened for modification C:\Program Files (x86)\altcmd\uninstall.bat e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File created C:\Program Files (x86)\altcmd\altcmd32.dll e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe File opened for modification C:\Program Files (x86)\altcmd\altcmd32.dll e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\ = "BhoApp Class" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\altcmd\\" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CurVer\ = "MsVCL1.BhoApp.1" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ThreadingModel = "Apartment" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\InprocServer32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS\ = "0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1\CLSID\ = "{32324134-3465-4325-6543-325435274523}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID\ = "MsVCL1.BhoApp" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp.1 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\ = "MsVCL1 1.0 Type Library" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\FLAGS e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\CLSID\ = "{32324134-3465-4325-6543-325435274523}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ = "BhoApp Class" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\TypeLib\ = "{A5432564-1E04-32A3-A23E-324EDC324CD6}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp\ = "BhoApp Class" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\ProgID\ = "MsVCL1.BhoApp.1" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MsVCL1.BhoApp e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A5432564-1E04-32A3-A23E-324EDC324CD6}\1.0\0\win32\ = "C:\\Program Files (x86)\\altcmd\\altcmd32.dll" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\VersionIndependentProgID e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32324134-3465-4325-6543-325435274523}\Programmable e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3792 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3792 wrote to memory of 4684 3792 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe 81 PID 3792 wrote to memory of 4684 3792 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe 81 PID 3792 wrote to memory of 4684 3792 e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe"C:\Users\Admin\AppData\Local\Temp\e0d594c1a6642747995745aa4a1cd577417172632befdbe894533430fb045ae6.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\CEBE.bat2⤵PID:4684
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5968158bf7662cea9e0f5c89b97a81a12
SHA15eb4903d8cf6448b97c5f5f25e9e89351b53919f
SHA256c3131cdc0d4f9adf633b2e58b05730924f284fc8e51a7bf90151a7a075dc750f
SHA5123962378f0f76b1f4a1846bd957a1eaa10a3222bd8d26e44705845c5f395d2284e7af9045bf379ad23019e4a24a5313a31e5b1f139f80ff20d767dd9febe45744
-
Filesize
295B
MD55dcec37527dcca591c79a2fcce0cc177
SHA1bd4c7b16c0b5969ad0b7591fd1c2198352c5c29d
SHA256a53cb6297c7c7b9c3727ff17e9742148f8ac6cd7c9abc16e2311b2e084df0169
SHA51298b44bddc3e78e761e85cc1a1da0007d4aa1c5a139ff2da552014948a338ca912522bb418618201d561d7aa6036dfa395d24ed6dcffb3ac94f2ca8fffd3ca27a