Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/03/2023, 01:44

230303-b6arcsfc9s 10

03/03/2023, 01:42

230303-b4nv7sfc7z 7

03/03/2023, 01:39

230303-b2ymmafg72 8

Analysis

  • max time kernel
    1801s
  • max time network
    1270s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/03/2023, 01:44

General

  • Target

    regdelete-readme-edits/hell9o.exe

  • Size

    172KB

  • MD5

    2e933118fecbaf64bbd76514c47a2164

  • SHA1

    a70a1673c4c7d0c0c12bc42bc676a1e9a09edc21

  • SHA256

    5268359ebc3f9e709c8eee1fa9d3e7c579b3e4563fabb9c394abe0fe2e39137f

  • SHA512

    c34672e55625462d16051cd725c96d634e459d61a9552f858f0b234d5eedf67594ca336f4fd695e3046c4e0485d4fa4497b6c604ee4144c49a6c1c0838628bdb

  • SSDEEP

    3072:xBtaM5EWCrATe105GWp1icKAArDZz4N9GhbkrNEk1lM:ZaM5zbp0yN90QEp

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
  • Modifies firewall policy service 2 TTPs 16 IoCs
  • Modifies security service 2 TTPs 8 IoCs
  • Modifies Installed Components in the registry 2 TTPs 58 IoCs
  • Registers new Print Monitor 2 TTPs 13 IoCs
  • Sets file execution options in registry 2 TTPs 47 IoCs
  • Modifies system executable filetype association 2 TTPs 49 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 7 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 59 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\regdelete-readme-edits\hell9o.exe
    "C:\Users\Admin\AppData\Local\Temp\regdelete-readme-edits\hell9o.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Windows\system32\reg.exe
        reg DELETE HKEY_CLASSES_ROOT /f
        3⤵
        • Modifies system executable filetype association
        • Registers COM server for autorun
        • Modifies registry class
        PID:4332
      • C:\Windows\system32\reg.exe
        reg DELETE HKEY_CURRENT_USER /f
        3⤵
          PID:3760
        • C:\Windows\system32\reg.exe
          reg DELETE HKEY_LOCAL_MACHINE /f
          3⤵
            PID:1960
          • C:\Windows\system32\reg.exe
            reg DELETE HKEY_USERS /f
            3⤵
              PID:4244
            • C:\Windows\system32\reg.exe
              reg DELETE HKEY_CURRENT_CONFIG /f
              3⤵
                PID:1928
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD
              2⤵
                PID:4328
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 456 -p 3548 -ip 3548
              1⤵
                PID:4416
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 3548 -s 1620
                1⤵
                • Program crash
                PID:3248
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
                1⤵
                  PID:1620
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                  1⤵
                    PID:2132
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 532 -p 2664 -ip 2664
                    1⤵
                      PID:3916
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 2664 -s 1568
                      1⤵
                      • Program crash
                      PID:4884
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 560 -p 3740 -ip 3740
                      1⤵
                        PID:3404
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 3740 -s 3900
                        1⤵
                        • Program crash
                        PID:4980
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 412 -p 352 -ip 352
                        1⤵
                          PID:5112
                        • C:\Windows\System32\smss.exe
                          \SystemRoot\System32\smss.exe 00000104 00000084
                          1⤵
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Modifies registry class
                          PID:1960
                        • C:\Windows\System32\smss.exe
                          \SystemRoot\System32\smss.exe 00000114 00000084
                          1⤵
                          • Modifies Installed Components in the registry
                          • Modifies system executable filetype association
                          • Adds Run key to start application
                          • Modifies Internet Explorer settings
                          PID:3760

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD

                          Filesize

                          159B

                          MD5

                          e26bcceba32f987399a0decf331f0697

                          SHA1

                          64540b56c5ff6dbb963faa50a85159c62edf7365

                          SHA256

                          0fd1b221f5a865fd9d796857f51724ad6460d409e2cffe8cfaef091daa689d05

                          SHA512

                          d96236da499970dfd6702150a5140e947547e50e3ec6b5ee3d7923ddcc637a01a9e747ecac0b81d4268cbe1a7788c63d5b4ec1373fc46318d8a5d676f510d508

                        • memory/2132-137-0x0000019AE5440000-0x0000019AE5450000-memory.dmp

                          Filesize

                          64KB

                        • memory/2132-153-0x0000019AE5540000-0x0000019AE5550000-memory.dmp

                          Filesize

                          64KB

                        • memory/2132-169-0x0000019AEDB30000-0x0000019AEDB31000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-170-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-171-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-172-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-173-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-174-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-175-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-176-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-177-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-178-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-179-0x0000019AEDB50000-0x0000019AEDB51000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-180-0x0000019AED780000-0x0000019AED781000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-181-0x0000019AED770000-0x0000019AED771000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-183-0x0000019AED780000-0x0000019AED781000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-186-0x0000019AED770000-0x0000019AED771000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-189-0x0000019AED6B0000-0x0000019AED6B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-201-0x0000019AED8B0000-0x0000019AED8B1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-203-0x0000019AED8C0000-0x0000019AED8C1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-204-0x0000019AED8C0000-0x0000019AED8C1000-memory.dmp

                          Filesize

                          4KB

                        • memory/2132-205-0x0000019AED9D0000-0x0000019AED9D1000-memory.dmp

                          Filesize

                          4KB