Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
23/09/2023, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe
Resource
win10v2004-20230915-en
General
-
Target
7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe
-
Size
75KB
-
MD5
3213a6b12ab6e858c29394b46b600714
-
SHA1
e2867a66e24a661041cb6a6149b4fd6bec44feac
-
SHA256
7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9
-
SHA512
3cb34859ac5832797e135fadfc3b56a338c4c6743e5259d147cfd17502ed25c6ff47d21c01dde88043ce730c1270334e1784912e40a6af4185a9a573583f0990
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOeYh:GhfxHNIreQm+HiBYh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2908 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe File created C:\Windows\SysWOW64\¢«.exe 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe File created C:\Windows\system\rundll32.exe 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1695452802" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1695452802" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2908 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 532 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 2908 rundll32.exe 2908 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4520 wrote to memory of 2908 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 86 PID 4520 wrote to memory of 2908 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 86 PID 4520 wrote to memory of 2908 4520 7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe"C:\Users\Admin\AppData\Local\Temp\7a9632a18ef967eb84cc087921f1c3a72e638959cbbd4454efb2d447420b05c9.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4652
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD593b9d95f28a0375e94a2670bbb456e71
SHA184b3cc9160de726841ad2c044c859b41184f149c
SHA256541c486e7b0141e3619a7977df984001d8faaab6bb6f1eb10cff179970e583a6
SHA512539a8752e39e56911be217effdbb68fab88ffd8bd897795130c62d17e20991726a751751bb2a4efa3652d0981d5ddf5f1a19d5abcfb0e358220f61ab168adde2
-
Filesize
81KB
MD52995096ee91e04e0a8ba2aff104ea555
SHA18537d0559796d3066acaedb9453e461492f33732
SHA256c906459f115a04301a88fd4f842265465c305f564b4e06c8c0a8fe27f93e2318
SHA5122db39e5df3877bd2bc5fede50c5a89b7ab6123c4697a1f077a6301da94837201124dcaa02e79debd0ea746857668ab4262b057d4ca52ecca961d0d0c699eabde
-
Filesize
81KB
MD52995096ee91e04e0a8ba2aff104ea555
SHA18537d0559796d3066acaedb9453e461492f33732
SHA256c906459f115a04301a88fd4f842265465c305f564b4e06c8c0a8fe27f93e2318
SHA5122db39e5df3877bd2bc5fede50c5a89b7ab6123c4697a1f077a6301da94837201124dcaa02e79debd0ea746857668ab4262b057d4ca52ecca961d0d0c699eabde