Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe
Resource
win10v2004-20220812-en
General
-
Target
bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe
-
Size
11KB
-
MD5
c6d7967ab3347358fff22cd9b654e2b6
-
SHA1
62f84e8179b9878d74366a9163ac426f6bfe4873
-
SHA256
bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3
-
SHA512
5b749ef19046624a21402c551d761ab27c5ab3cf80ee212177121bb1c06cd7844dd457db1775fb2e6e8b5f1e1dd8f264e9109855aca832b272a5b7eb4591a900
-
SSDEEP
192:nkCq7UjdfyHcKWQDBzwUAtIHAx+KXWKcnbugX0Z07LU+/SvSV1tHDYySokS:nBfyDBzwUs+EVcnSgdLrSvSruykS
Malware Config
Signatures
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\LocalServer32 bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\LocalServer32 bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\Data bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76} bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe" bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\Data bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\Data\ = 00000000660b987100000000000000000000000000000000 bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76} bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe" bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{792A7399-EFD6-BE18-B4C0-8507E3A13B76}\Data\ = 00000000660b987100000000000000000000000000000000 bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe"C:\Users\Admin\AppData\Local\Temp\bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe"1⤵
- Modifies registry class
PID:1256
-
C:\Users\Admin\AppData\Local\Temp\bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe"C:\Users\Admin\AppData\Local\Temp\bbab73d0074e1731d4431cc334c41080bcbe26427ce4c61960888400e32fb6c3.exe" /s1⤵
- Modifies registry class
PID:1528