Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe
Resource
win10v2004-20220812-en
General
-
Target
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe
-
Size
42KB
-
MD5
c6b81c7fb7d688711923a3774432f42d
-
SHA1
a4df01899ea43820b1661c57175019dfd6e602a3
-
SHA256
cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
-
SHA512
9f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
SSDEEP
768:uBUaZmvRRaO52tjS+YC5tZvx0HRVzJ1gFqDhgpVmcLek/c3Lqyu9usvSKvQkv:uBc6GC5bpMMuCuCek/c3LqbEWvQkv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1064 hdnzcucu.exe 1716 hdnzcucu.exe -
Deletes itself 1 IoCs
pid Process 1064 hdnzcucu.exe -
Loads dropped DLL 6 IoCs
pid Process 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 1064 hdnzcucu.exe 1064 hdnzcucu.exe 1064 hdnzcucu.exe 1064 hdnzcucu.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\hdnzcucu.exe cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe File opened for modification \??\c:\windows\SysWOW64\hdnzcucu.exe cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001} cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hdnzcucu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 hdnzcucu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000001}\InprocServer32 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1508 wrote to memory of 916 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 27 PID 1508 wrote to memory of 916 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 27 PID 1508 wrote to memory of 916 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 27 PID 1508 wrote to memory of 916 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 27 PID 1508 wrote to memory of 916 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 27 PID 1508 wrote to memory of 916 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 27 PID 1508 wrote to memory of 916 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 27 PID 1508 wrote to memory of 1064 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 28 PID 1508 wrote to memory of 1064 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 28 PID 1508 wrote to memory of 1064 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 28 PID 1508 wrote to memory of 1064 1508 cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe 28 PID 1064 wrote to memory of 1992 1064 hdnzcucu.exe 29 PID 1064 wrote to memory of 1992 1064 hdnzcucu.exe 29 PID 1064 wrote to memory of 1992 1064 hdnzcucu.exe 29 PID 1064 wrote to memory of 1992 1064 hdnzcucu.exe 29 PID 1064 wrote to memory of 1992 1064 hdnzcucu.exe 29 PID 1064 wrote to memory of 1992 1064 hdnzcucu.exe 29 PID 1064 wrote to memory of 1992 1064 hdnzcucu.exe 29 PID 1064 wrote to memory of 1716 1064 hdnzcucu.exe 30 PID 1064 wrote to memory of 1716 1064 hdnzcucu.exe 30 PID 1064 wrote to memory of 1716 1064 hdnzcucu.exe 30 PID 1064 wrote to memory of 1716 1064 hdnzcucu.exe 30 PID 1716 wrote to memory of 1212 1716 hdnzcucu.exe 31 PID 1716 wrote to memory of 1212 1716 hdnzcucu.exe 31 PID 1716 wrote to memory of 1212 1716 hdnzcucu.exe 31 PID 1716 wrote to memory of 1212 1716 hdnzcucu.exe 31 PID 1716 wrote to memory of 1212 1716 hdnzcucu.exe 31 PID 1716 wrote to memory of 1212 1716 hdnzcucu.exe 31 PID 1716 wrote to memory of 1212 1716 hdnzcucu.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe"C:\Users\Admin\AppData\Local\Temp\cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s2⤵PID:916
-
-
C:\windows\SysWOW64\hdnzcucu.exe"C:\windows\system32\hdnzcucu.exe" -kill c:\users\admin\appdata\local\temp\cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a.exe /install2⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s3⤵PID:1992
-
-
C:\windows\SysWOW64\hdnzcucu.exe"C:\windows\system32\hdnzcucu.exe" -kill c:\windows\syswow64\hdnzcucu.exe /install /install3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Windows\system32\SafeSearch.dll /u /s4⤵PID:1212
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1
-
Filesize
42KB
MD5c6b81c7fb7d688711923a3774432f42d
SHA1a4df01899ea43820b1661c57175019dfd6e602a3
SHA256cf0f6a60ac2c37799b02f26581cc92b2c346bfcdd757d2b459b969ea0e76867a
SHA5129f6f830745ff0d1125d94ac54ed8e0851660ff37142798706c13af6aec854e2e5590d2e5749f01ea629867a506b896bb63ce8fc9fc4cab12a6154b6bf07961a1