Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

c345188068...3c.exe

windows7-x64

10

c345188068...3c.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 05:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c345188068f9782668cbaa5ab96e709755dc9a71d3007c0b36c92ddf832b8d3c.exe

  • Size

    288KB

  • MD5

    51ad8a661f099f67c9da952936065544

  • SHA1

    629b12f3ea32b4bd4aca247527b71f5b74335cf9

  • SHA256

    c345188068f9782668cbaa5ab96e709755dc9a71d3007c0b36c92ddf832b8d3c

  • SHA512

    56a0471a63f2558dcc6643933b6739af7b34ae73ee040a8fdea33416e4ff015a3da0259371d3ea4c6f289c34629060ad23e0d9741d87a10362281cf2aae81581

  • SSDEEP

    6144:hzi7QZJReclOa+8/iNoC8r6axpu4+pVRo8X1NL:hzsaJReclOwiWvuxVRo8ll

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 17 IoCs
    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c345188068f9782668cbaa5ab96e709755dc9a71d3007c0b36c92ddf832b8d3c.exe
    "C:\Users\Admin\AppData\Local\Temp\c345188068f9782668cbaa5ab96e709755dc9a71d3007c0b36c92ddf832b8d3c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Users\Admin\AppData\Local\kmb.exe
      "C:\Users\Admin\AppData\Local\kmb.exe" -gav C:\Users\Admin\AppData\Local\Temp\c345188068f9782668cbaa5ab96e709755dc9a71d3007c0b36c92ddf832b8d3c.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1988
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1708
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x4d8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1352

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\kmb.exe
    Filesize

    288KB

    MD5

    d7058298ed4e2af78254ddc2935395ff

    SHA1

    1e76fbd764255d662f295df2b38d9b33cd3d3c14

    SHA256

    f438dadeb46b67ccc82f72ffe34f59ce82a65f115eec39e3826a83c0960ba9c3

    SHA512

    6267ec1a5debe08e8986f3c04f99966729630fb5a12608976fa5c233927a67885390c5504a411f0cb52e4aa86293da7af2e9e7889d4334e931aa522f1526e20d

    Download Submit

  • C:\Users\Admin\AppData\Local\kmb.exe
    Filesize

    288KB

    MD5

    d7058298ed4e2af78254ddc2935395ff

    SHA1

    1e76fbd764255d662f295df2b38d9b33cd3d3c14

    SHA256

    f438dadeb46b67ccc82f72ffe34f59ce82a65f115eec39e3826a83c0960ba9c3

    SHA512

    6267ec1a5debe08e8986f3c04f99966729630fb5a12608976fa5c233927a67885390c5504a411f0cb52e4aa86293da7af2e9e7889d4334e931aa522f1526e20d

    Download Submit

  • \Users\Admin\AppData\Local\kmb.exe
    Filesize

    288KB

    MD5

    d7058298ed4e2af78254ddc2935395ff

    SHA1

    1e76fbd764255d662f295df2b38d9b33cd3d3c14

    SHA256

    f438dadeb46b67ccc82f72ffe34f59ce82a65f115eec39e3826a83c0960ba9c3

    SHA512

    6267ec1a5debe08e8986f3c04f99966729630fb5a12608976fa5c233927a67885390c5504a411f0cb52e4aa86293da7af2e9e7889d4334e931aa522f1526e20d

    Download Submit

  • \Users\Admin\AppData\Local\kmb.exe
    Filesize

    288KB

    MD5

    d7058298ed4e2af78254ddc2935395ff

    SHA1

    1e76fbd764255d662f295df2b38d9b33cd3d3c14

    SHA256

    f438dadeb46b67ccc82f72ffe34f59ce82a65f115eec39e3826a83c0960ba9c3

    SHA512

    6267ec1a5debe08e8986f3c04f99966729630fb5a12608976fa5c233927a67885390c5504a411f0cb52e4aa86293da7af2e9e7889d4334e931aa522f1526e20d

    Download Submit

  • memory/784-58-0x0000000002140000-0x00000000023F7000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/784-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/784-57-0x0000000000230000-0x0000000000235000-memory.dmp

    Filesize

    20KB

    Download

  • memory/784-56-0x0000000000400000-0x00000000005F7000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/784-63-0x0000000000400000-0x00000000005F7000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/784-55-0x0000000000220000-0x0000000000229000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1708-64-0x000007FEFB2C1000-0x000007FEFB2C3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1708-71-0x0000000002640000-0x0000000002650000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1988-67-0x0000000000400000-0x00000000005F7000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1988-68-0x0000000000230000-0x0000000000235000-memory.dmp

    Filesize

    20KB

    Download

  • memory/1988-69-0x0000000074211000-0x0000000074213000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1988-70-0x0000000000400000-0x00000000005F7000-memory.dmp

    Filesize

    2.0MB

    Download