Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe
Resource
win7-20220901-en
General
-
Target
99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe
-
Size
177KB
-
MD5
1e6054e7c0223d0c1508cbe1f7385be5
-
SHA1
81dd2d3672a77e30814cc0f2dc33b1060e36fea5
-
SHA256
99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94
-
SHA512
66b69db35b8d8a7fd500d46fcea38e714e5a33bb4947a091ec4b3d266707c578f7a468b1764e0a5b86a2045b86cd7e10572c4415c40ed070fa272da63c8649de
-
SSDEEP
3072:RWM9GVvfUoNkaCGaHz+BUVC6GrVM5OXAfVXbmeWcnb:cpVvfUyka4qBiLSVMIXANXbmeR
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1704 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E71F5184-35A9-3C29-99D1-B72C4506A596} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E71F5184-35A9-3C29-99D1-B72C4506A596}\IExplore = "1" regsvr32.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\mws77814.dll 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe File opened for modification C:\Windows\SysWOW64\mws77814.dll 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe File created C:\Windows\SysWOW64\ws77814.dll 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 29 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ = "ID" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\ = "{B73CA827-1C54-3A2F-B472-98022A047863}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\ = "LIB" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ = "ID" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mws77814.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib\ = "{B73CA827-1C54-3A2F-B472-98022A047863}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\InprocServer32\ = "C:\\Windows\\SysWow64\\mws77814.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\ = "D" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADC88302-3032-3749-962B-497DBD27ED95}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E71F5184-35A9-3C29-99D1-B72C4506A596}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B73CA827-1C54-3A2F-B472-98022A047863}\1.0\FLAGS regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1704 1464 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe 27 PID 1464 wrote to memory of 1704 1464 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe 27 PID 1464 wrote to memory of 1704 1464 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe 27 PID 1464 wrote to memory of 1704 1464 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe 27 PID 1464 wrote to memory of 1704 1464 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe 27 PID 1464 wrote to memory of 1704 1464 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe 27 PID 1464 wrote to memory of 1704 1464 99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe"C:\Users\Admin\AppData\Local\Temp\99781fbb2f113151f93db63ae600dab39799ee27f41f99e9b15952986beb5d94.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\mws77814.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1704
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD53d866f8eb363d9f57f473e663d5cfdda
SHA1b336650ff8899dfd76e901bf6d8cf02c9283ba6e
SHA2562d8b5fb77b8f24879a50f32fd99490543ea0a684fb1d8195f7a318b9977a40b8
SHA5126ad6bac7a5e44d984f3dbf76040dad3fd7a29f73cb97ff6606d36e2e5504a616fa785a36e3ffb5e257d53fd09fe5f856e3a6ec6c59ddaf8349deaa34fcd41da9
-
Filesize
172KB
MD53d866f8eb363d9f57f473e663d5cfdda
SHA1b336650ff8899dfd76e901bf6d8cf02c9283ba6e
SHA2562d8b5fb77b8f24879a50f32fd99490543ea0a684fb1d8195f7a318b9977a40b8
SHA5126ad6bac7a5e44d984f3dbf76040dad3fd7a29f73cb97ff6606d36e2e5504a616fa785a36e3ffb5e257d53fd09fe5f856e3a6ec6c59ddaf8349deaa34fcd41da9