Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe
Resource
win10v2004-20220901-en
General
-
Target
be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe
-
Size
306KB
-
MD5
b4d31796460de48099b671560fcc3499
-
SHA1
f461422b898da0e0c2f5154e8af4f17889011fd0
-
SHA256
be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b
-
SHA512
c9bcdf8edd7af02e154e53035817561f1c5a4a7801d73a884f41d79ce253756d063d89bbc68b0af37e41efa12288c28b374aa0a4a069e69c7a18f0e764a41f14
-
SSDEEP
6144:YOUyfOlOeb65u5BLxllHFh36pST6pz7FvAuHSX:YOUyCmA5BLbZLqQT65SX
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\Windows\\system32\\ctfmonzyp.exe" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe regsvr32.exe -
Loads dropped DLL 1 IoCs
pid Process 1964 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EAC1B500-7864-3DA6-99F0-35361D557923} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EAC1B500-7864-3DA6-99F0-35361D557923}\IExplore = "1" regsvr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmonzyp.exe regsvr32.exe File created C:\Windows\SysWOW64\la49859.dll be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\ = "LIB" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\ProgID\ = "D.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\InprocServer32\ = "C:\\Windows\\SysWow64\\la49859.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\ = "IDOMPeek" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\VersionIndependentProgID\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\la49859.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\ = "IDOMPeek" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\D.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\ = "D" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\TypeLib\ = "{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA}\TypeLib\ = "{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID\ = "{EAC1B500-7864-3DA6-99F0-35361D557923}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID\ = "{EAC1B500-7864-3DA6-99F0-35361D557923}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAC1B500-7864-3DA6-99F0-35361D557923}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D5C191D3-DB74-3A8C-83B7-841E8D34FB2C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E33E0D3-5E99-3F42-A954-93031F8587DA} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1964 1368 be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe 27 PID 1368 wrote to memory of 1964 1368 be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe 27 PID 1368 wrote to memory of 1964 1368 be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe 27 PID 1368 wrote to memory of 1964 1368 be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe 27 PID 1368 wrote to memory of 1964 1368 be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe 27 PID 1368 wrote to memory of 1964 1368 be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe 27 PID 1368 wrote to memory of 1964 1368 be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe"C:\Users\Admin\AppData\Local\Temp\be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\la49859.dll2⤵
- Sets file execution options in registry
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
PID:1964
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD544a68340ef53f83e8fb0ffc33ab7e115
SHA1c0ec550b3ed6aafc362fe552896a3e9dc4f81b04
SHA25652f6b0377503192d6509e3a560453e16c0128594c1be5503836e1bc58c7913fe
SHA51264088819d94e0d8245fd4a16a2104898e254204fa23797b0b133c1b3e6a13c7b1d262ba0a7710535573a2eddd2966b10ff8e761ecd143820387a221c7c0ab130
-
Filesize
240KB
MD544a68340ef53f83e8fb0ffc33ab7e115
SHA1c0ec550b3ed6aafc362fe552896a3e9dc4f81b04
SHA25652f6b0377503192d6509e3a560453e16c0128594c1be5503836e1bc58c7913fe
SHA51264088819d94e0d8245fd4a16a2104898e254204fa23797b0b133c1b3e6a13c7b1d262ba0a7710535573a2eddd2966b10ff8e761ecd143820387a221c7c0ab130