Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe
Resource
win10v2004-20220812-en
General
-
Target
c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe
-
Size
14KB
-
MD5
41d37ea07c5237c87ef69336b1e530be
-
SHA1
1b7e9517327c5dd0d22a46f6728e81936c4a41fa
-
SHA256
c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387
-
SHA512
73390d5b51fc5f2f227c562c38c131ff10205b9c6df10cc8cf44375aa8a348a5140f94e5766c22dba556a2c2eac53d525af6deacf3a43e26a565454cfc1ac086
-
SSDEEP
384:CcfGqHxrz554Ep/oehlanftPzY1RkeZ+JC:C8GOxrX4E9llanfF01RkY+J
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 5108 c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe -
Modifies WinLogon 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kdufroa\Impersonate = "1" c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kdufroa\Asynchronous = "1" c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kdufroa\MaxWait = "1" c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kdufroa\zmakjuui = 47e7fcb91e9df3e7b947 c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kdufroa c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kdufroa\DllName = "C:\\Users\\Admin\\AppData\\Local\\kdufroa.dll" c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kdufroa\Startup = "kdufroa" c45eb0f8bcad12ac47566c048e33ab36152b5f8e12f34a0d8b3f7a00d6180387.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD53d671c6ed6249170ac15c9076a8a8b51
SHA1170e52462f3dbadc1bf5e9b35dd25604d747d415
SHA2567b3240a0342ebad54aaf086c340f0f30c51f81fd048902799a3e94f268f33deb
SHA5128fd9f306f442256851e1839c39607d335c5379488cfde917ee8c13f8755bc9bb010dd9cd77b99d672cbcbb5bf88ae46bef74078cc5eaf2b75146ccccd2c41992