Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/01/2023, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
process.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
process.exe
-
Size
258KB
-
MD5
4b845f07de6d5d8ad72a57d9169f69be
-
SHA1
cfec4bce14ce9c85350f8f943c1ab8068be9e42b
-
SHA256
0dd112b4f23ce4ad0d6619dc2686b58f686ad47509c4e9a66b045a7385ebda64
-
SHA512
b15b8b57ea5bdbbb4f1fda0036560d1f0ee89d0122dac92ddd816897312fd5d6c0219e7898d85a88649283790887ef74fa5b317cdf1cb6452fb9484f441854fe
-
SSDEEP
6144:4I4vO0B+oVTIn0UAaH0neolFc6hoPnJEdRcgY5STm:yvpBRBInQ7bc6hMJEdRcgY
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
pid Process 2004 process.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000} process.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 820 sc.exe 1456 sc.exe 816 sc.exe -
Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ProgID process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32 process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\ = "IEHlprObj Class" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32 process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\FLAGS\ = "0" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\HELPDIR process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\ = "{CE7C3CE2-4B15-11D1-ABED-709549C10000}" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\Version = "1.0" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\ = "IEHlprObj.IEHlprObj.1" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ = "IEHlprObj Class" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ = "IIEHlprObj" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1 process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\ = "IEHlprObj Class" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000} process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\0\win32 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32 process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\Version = "1.0" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ProgID\ = "IEHlprObj.IEHlprObj.1" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000} process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\ = "{CE7C3CE2-4B15-11D1-ABED-709549C10000}" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\Programmable process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEHelper.dll" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\ = "IEHelper 1.0 Type Library" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\0 process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEHelper.dll" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID\ = "{CE7C3CF0-4B15-11D1-ABED-709549C10000}" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID\ = "IEHlprObj.IEHlprObj" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32\ThreadingModel = "Apartment" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\FLAGS process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ = "IIEHlprObj" process.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2004 process.exe Token: SeShutdownPrivilege 1352 Process not Found Token: SeShutdownPrivilege 1352 Process not Found -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1696 2004 process.exe 27 PID 2004 wrote to memory of 1696 2004 process.exe 27 PID 2004 wrote to memory of 1696 2004 process.exe 27 PID 2004 wrote to memory of 1696 2004 process.exe 27 PID 1696 wrote to memory of 1456 1696 cmd.exe 28 PID 1696 wrote to memory of 1456 1696 cmd.exe 28 PID 1696 wrote to memory of 1456 1696 cmd.exe 28 PID 1696 wrote to memory of 1456 1696 cmd.exe 28 PID 2004 wrote to memory of 1784 2004 process.exe 30 PID 2004 wrote to memory of 1784 2004 process.exe 30 PID 2004 wrote to memory of 1784 2004 process.exe 30 PID 2004 wrote to memory of 1784 2004 process.exe 30 PID 1784 wrote to memory of 816 1784 cmd.exe 31 PID 1784 wrote to memory of 816 1784 cmd.exe 31 PID 1784 wrote to memory of 816 1784 cmd.exe 31 PID 1784 wrote to memory of 816 1784 cmd.exe 31 PID 2004 wrote to memory of 1080 2004 process.exe 32 PID 2004 wrote to memory of 1080 2004 process.exe 32 PID 2004 wrote to memory of 1080 2004 process.exe 32 PID 2004 wrote to memory of 1080 2004 process.exe 32 PID 1080 wrote to memory of 820 1080 cmd.exe 33 PID 1080 wrote to memory of 820 1080 cmd.exe 33 PID 1080 wrote to memory of 820 1080 cmd.exe 33 PID 1080 wrote to memory of 820 1080 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\process.exe"C:\Users\Admin\AppData\Local\Temp\process.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start stisvc2⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\sc.exesc start stisvc3⤵
- Launches sc.exe
PID:1456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wuauserv2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start wuauserv2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\sc.exesc start wuauserv3⤵
- Launches sc.exe
PID:820
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154KB
MD500b5bc89db9eb0a2bf915c834e2c31f5
SHA150367913472880e8b533750027de37d727cb5043
SHA25690523dfb329e6e732e5e7032bf316c806e8ff303f531a10461a1ab14639933e0
SHA5127ec041d61c581388a50f853a909e30bebdc6fdd8e39d2c5c9d9af1af4f707d480ae5f1a6eddea595d6538e5a25b0b55a6a9b7a3f3aba862c3702d496e3ae712c