Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe
Resource
win10v2004-20220901-en
General
-
Target
da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe
-
Size
434KB
-
MD5
0e2bca9e9eec75bba508ca21a673c1ba
-
SHA1
4f9c98c7bc787e5a3904b9ae7ed210546ed6fc15
-
SHA256
da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b
-
SHA512
aedd21b8ce455cbca20e2c8444e06849e0e1b49b57636741032f867bb40e14a0f47fe2d2d6840655e531af2c8131e3b22a5e41411ef9914108c14ed39a6bfaf8
-
SSDEEP
12288:/WWZmQtWsYtpyAEMYvu5fAT8hMn28f6sRE:pBtTAEM2u5fAzVf6p
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe D:\\RECYGLER" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe D:\\RECYGLER" regedit.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\msscp.reg da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe File opened for modification C:\Windows\SysWOW64\msscp.reg da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\taobao.ico da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe File opened for modification C:\Program Files\Common Files\System\taobao.ico da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TYPEDURLS da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://455555.net" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://455555.net" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe -
Modifies registry class 43 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\IsShortCut regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\internet explorer\\IEXPLORE.EXE,0" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.html da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "htmlfile" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\ = "htmfileico" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\1 = "20221211" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\cdafile2 = "42214" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "0" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\ = "htmfileico" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\internet explorer\\IEXPLORE.EXE,0" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" \"%1\"" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H) regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" \"%1\"" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\IsShortCut regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon\ = "C:\\Program Files\\Common Files\\System\\taobao.ico" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H) regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\ = "htmfile" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.html da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon\ = "C:\\Program Files\\Common Files\\System\\taobao.ico" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command\ = "D:\\Program\\3610\\360Safe.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "htmlfile" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command\ = "D:\\Program\\3610\\360Safe.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "1" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\ = "htmfile" da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe -
Runs .reg file with regedit 2 IoCs
pid Process 384 regedit.exe 1896 regedit.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1508 wrote to memory of 384 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 27 PID 1508 wrote to memory of 384 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 27 PID 1508 wrote to memory of 384 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 27 PID 1508 wrote to memory of 384 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 27 PID 1508 wrote to memory of 1148 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 28 PID 1508 wrote to memory of 1148 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 28 PID 1508 wrote to memory of 1148 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 28 PID 1508 wrote to memory of 1148 1508 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 28 PID 1148 wrote to memory of 1896 1148 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 29 PID 1148 wrote to memory of 1896 1148 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 29 PID 1148 wrote to memory of 1896 1148 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 29 PID 1148 wrote to memory of 1896 1148 da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe"C:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg2⤵
- Modifies WinLogon for persistence
- Modifies registry class
- Runs .reg file with regedit
PID:384
-
-
C:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exeC:\Users\Admin\AppData\Local\Temp\da1124a617761808836118fbfacdc50a6ed406b7e269946bcb9ecef0b88ede2b.exe2⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg3⤵
- Modifies WinLogon for persistence
- Modifies registry class
- Runs .reg file with regedit
PID:1896
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5468fada123f5548ac87e57bae81f6782
SHA1edb8f012c25906e6afd8bf335b495e16c440243d
SHA256091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d
SHA512635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa
-
Filesize
1KB
MD52a645eb5023a526549f59a9ff4e5270d
SHA10b0dcba132e7e83d9d5c4bb74a745109299c1bfd
SHA2561ce92aff6ba1628f372ff559fbc787475b473f59d0797f2cbf627d619fa31d42
SHA512a8de7ba1dd17b3f842bd995e71fd63a224a1483296fc4a1560d11fc132741a45188b7ade6f5d21b7bf64d4a029728268ebe1698d4a13abd2a7e180b06b8b3a33
-
Filesize
1KB
MD52a645eb5023a526549f59a9ff4e5270d
SHA10b0dcba132e7e83d9d5c4bb74a745109299c1bfd
SHA2561ce92aff6ba1628f372ff559fbc787475b473f59d0797f2cbf627d619fa31d42
SHA512a8de7ba1dd17b3f842bd995e71fd63a224a1483296fc4a1560d11fc132741a45188b7ade6f5d21b7bf64d4a029728268ebe1698d4a13abd2a7e180b06b8b3a33