Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
237s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe
Resource
win10v2004-20220812-en
General
-
Target
aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe
-
Size
70KB
-
MD5
ccb8d4614785878db8cb84dc45ba5141
-
SHA1
59224474f4df8b8a489f5dd326861fc138728b8d
-
SHA256
aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4
-
SHA512
7c13baf94d256a0d26fcc5572f485d94b4ae664465e44e1a6a930ba3359b0a71acb1b08052250cc7d9b13df41aa513631f4f542546ede0b14084fa87146472b4
-
SSDEEP
1536:oPei8NowvzI7uJANRipkezzUUnxnQfKwraqrUUvMoufxRuRK:oynzI7uJ6qk04UnnNq4YQZx
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe -
Deletes itself 1 IoCs
pid Process 1900 cmd.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{39fc2065-c9c7-49cd-8942-44cc2dedc844} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\NoExplorer = "1" regsvr32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ieocx.dll aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\don't load\wscui.cpl = "No" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\don't load aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\don't load\scui.cpl = "No" aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib\ = "{B360243E-09E8-402F-8721-00B6798089AD}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet.1\ = "WinInet Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\TypeLib\ = "{b360243e-09e8-402f-8721-00b6798089ad}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\HELPDIR\ = "C:\\Windows" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ = "_IBhoAppEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{B360243E-09E8-402F-8721-00B6798089AD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet\ = "WinInet Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ = "_IBhoAppEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\0\win32\ = "C:\\Windows\\ieocx.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet.1\CLSID\ = "{39fc2065-c9c7-49cd-8942-44cc2dedc844}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{B360243E-09E8-402F-8721-00B6798089AD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\ = "WinInet 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet\CurVer\ = "WinInetApp.WinInet.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\ProgID\ = "WinInetApp.WinInet.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\ = "WinInet Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\InprocServer32\ = "C:\\Windows\\ieocx.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B360243E-09E8-402F-8721-00B6798089AD}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib\ = "{B360243E-09E8-402F-8721-00B6798089AD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinInetApp.WinInet\CLSID\ = "{39fc2065-c9c7-49cd-8942-44cc2dedc844}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{39fc2065-c9c7-49cd-8942-44cc2dedc844}\VersionIndependentProgID\ = "WinInetApp.WinInet" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B66E1DF-4DE3-4CDA-83B5-11673EADAB0B}\TypeLib regsvr32.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1564 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 28 PID 1476 wrote to memory of 1564 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 28 PID 1476 wrote to memory of 1564 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 28 PID 1476 wrote to memory of 1564 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 28 PID 1476 wrote to memory of 1564 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 28 PID 1476 wrote to memory of 1564 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 28 PID 1476 wrote to memory of 1564 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 28 PID 1476 wrote to memory of 924 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 29 PID 1476 wrote to memory of 924 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 29 PID 1476 wrote to memory of 924 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 29 PID 1476 wrote to memory of 924 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 29 PID 924 wrote to memory of 1252 924 net.exe 31 PID 924 wrote to memory of 1252 924 net.exe 31 PID 924 wrote to memory of 1252 924 net.exe 31 PID 924 wrote to memory of 1252 924 net.exe 31 PID 1476 wrote to memory of 1900 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 32 PID 1476 wrote to memory of 1900 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 32 PID 1476 wrote to memory of 1900 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 32 PID 1476 wrote to memory of 1900 1476 aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe"C:\Users\Admin\AppData\Local\Temp\aafc4d2e9cd2b2a19d121a23042160b0278fd3a2a5ae81ed5d516905e6dc84e4.exe"1⤵
- Windows security bypass
- Windows security modification
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\ieocx.dll2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1564
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe stop "Security Center"2⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"3⤵PID:1252
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\asd.bat" "2⤵
- Deletes itself
PID:1900
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292B
MD5df5521629b8fdae9eb3be1ff6796053c
SHA15bccb394daa6fe781014bee07b150bf6487caf0f
SHA25670e5393a5676722d867dca992cccbad9fb940c18e4aa6a9904077f438c630cb9
SHA5124b7b7f5167b92da32cc4ff5ffce37a608c122efdf936caca8314d312683f4c3a325fee05970b9a21870174b0006f236c2f256a8620a5bb232929ad7a475cc5ab
-
Filesize
28KB
MD5a10e6205c62802ad7c472bd5d003cb4a
SHA12bc0806195ae258cdab3f8f753f624bd07d729fa
SHA2561a04223a5dfc65a5ec55800e770dd0b3138eeace42120559385ae95535d9aa8c
SHA512adc92257e0eee52b61560f6c8d7d6e57b48082cb1abb98ba1cef3846442937a843f0f45c536fa9c85fae40a46d07708a70fd44a47018c360af1fe83873f2e075