Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
Resource
win10v2004-20220812-en
General
-
Target
c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
-
Size
57KB
-
MD5
172f8f458b8590b2eb430b6e33fd23d0
-
SHA1
2cd000a7c7843858733675f4980d4f711023e158
-
SHA256
c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935
-
SHA512
8d67f3d163860c382e91b290622f362b88c2587e6e60acfd95546276b07b32e77817b9934b4bf0dcdc7ebe10e28a095dcc3bad9ad7ac340de33d7f5f523e21b4
-
SSDEEP
1536:mUuXeVMdMikFVhxp2EK5X96Mb1kHSNlL0:mUuXeVMf1NJ1kHmo
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\explorer.exe c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl explorer.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin explorer.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db explorer.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz explorer.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{11DBB47C-A525-400B-9E80-A54615A090C0} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = 01000000000000009fbeb8fc6e09d901 explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer explorer.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerStartupTraceRecorded = "1" explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000082cdc0fb6e09d901 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c6f0c7fb6e09d901 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d1a0600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1272 c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1272 c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe 1272 c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe"C:\Users\Admin\AppData\Local\Temp\c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1272
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1404
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵PID:1668