Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
7acafd284e5d51efc67eaae1a515495e_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7acafd284e5d51efc67eaae1a515495e_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
7acafd284e5d51efc67eaae1a515495e_JC.exe
-
Size
91KB
-
MD5
7acafd284e5d51efc67eaae1a515495e
-
SHA1
c481f3ce2a973ae8775694de02607d0f6cd6e5a3
-
SHA256
a65949f9d7d617ebf933f5909f7c8e5e04b4060142af73468466add44fa6e590
-
SHA512
70db8bbf295202ba343bd4ef3e6d5e0e22273cb057f2584e720611f602d81da6f3ee0e8892cec421d7ddad73b83bea2cfa2e969c4f67fbf2702b878e2efc581c
-
SSDEEP
1536:OBDxJGWJf0K/m/TEq1uwskn7KGKYE6BXw5e+ZnfH:ODJGWmb/weuwdn7KGKYXindf
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Daekdooc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dddhpjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dddhpjof.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 7acafd284e5d51efc67eaae1a515495e_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 7acafd284e5d51efc67eaae1a515495e_JC.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddakjkqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddakjkqi.exe -
Executes dropped EXE 4 IoCs
pid Process 2980 Ddakjkqi.exe 1704 Daekdooc.exe 4656 Dddhpjof.exe 2312 Dmllipeg.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Ddakjkqi.exe 7acafd284e5d51efc67eaae1a515495e_JC.exe File created C:\Windows\SysWOW64\Gifhkeje.dll 7acafd284e5d51efc67eaae1a515495e_JC.exe File opened for modification C:\Windows\SysWOW64\Dddhpjof.exe Daekdooc.exe File created C:\Windows\SysWOW64\Dmllipeg.exe Dddhpjof.exe File created C:\Windows\SysWOW64\Ddakjkqi.exe 7acafd284e5d51efc67eaae1a515495e_JC.exe File created C:\Windows\SysWOW64\Daekdooc.exe Ddakjkqi.exe File opened for modification C:\Windows\SysWOW64\Daekdooc.exe Ddakjkqi.exe File created C:\Windows\SysWOW64\Ohmoom32.dll Ddakjkqi.exe File created C:\Windows\SysWOW64\Dddhpjof.exe Daekdooc.exe File created C:\Windows\SysWOW64\Amjknl32.dll Daekdooc.exe File opened for modification C:\Windows\SysWOW64\Dmllipeg.exe Dddhpjof.exe File created C:\Windows\SysWOW64\Kngpec32.dll Dddhpjof.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3480 2312 WerFault.exe 88 -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 7acafd284e5d51efc67eaae1a515495e_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll" Ddakjkqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll" Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Daekdooc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 7acafd284e5d51efc67eaae1a515495e_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 7acafd284e5d51efc67eaae1a515495e_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ddakjkqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Daekdooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dddhpjof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll" 7acafd284e5d51efc67eaae1a515495e_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dddhpjof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 7acafd284e5d51efc67eaae1a515495e_JC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 7acafd284e5d51efc67eaae1a515495e_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddakjkqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll" Dddhpjof.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4456 wrote to memory of 2980 4456 7acafd284e5d51efc67eaae1a515495e_JC.exe 85 PID 4456 wrote to memory of 2980 4456 7acafd284e5d51efc67eaae1a515495e_JC.exe 85 PID 4456 wrote to memory of 2980 4456 7acafd284e5d51efc67eaae1a515495e_JC.exe 85 PID 2980 wrote to memory of 1704 2980 Ddakjkqi.exe 86 PID 2980 wrote to memory of 1704 2980 Ddakjkqi.exe 86 PID 2980 wrote to memory of 1704 2980 Ddakjkqi.exe 86 PID 1704 wrote to memory of 4656 1704 Daekdooc.exe 87 PID 1704 wrote to memory of 4656 1704 Daekdooc.exe 87 PID 1704 wrote to memory of 4656 1704 Daekdooc.exe 87 PID 4656 wrote to memory of 2312 4656 Dddhpjof.exe 88 PID 4656 wrote to memory of 2312 4656 Dddhpjof.exe 88 PID 4656 wrote to memory of 2312 4656 Dddhpjof.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\7acafd284e5d51efc67eaae1a515495e_JC.exe"C:\Users\Admin\AppData\Local\Temp\7acafd284e5d51efc67eaae1a515495e_JC.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\Ddakjkqi.exeC:\Windows\system32\Ddakjkqi.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Daekdooc.exeC:\Windows\system32\Daekdooc.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\Dddhpjof.exeC:\Windows\system32\Dddhpjof.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\Dmllipeg.exeC:\Windows\system32\Dmllipeg.exe5⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 3966⤵
- Program crash
PID:3480
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2312 -ip 23121⤵PID:4356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5a716feb30e83bc5f732a3c194479cfd4
SHA19a9309e3681daa8f7c7b242a8ff759d451ec3362
SHA256c4566a6e135002f097a2dfa8c1e3a4fb39317aa51533d6a2cbc8d509db3e10c5
SHA51209328390650cc0f82bd62e91e9eaa39a5de67c41d79b2214b6cac9456c1b52d7acf559ad261b9e6be32574664ec2e5006145f9890fe8fe4aecab65739615c955
-
Filesize
91KB
MD5a716feb30e83bc5f732a3c194479cfd4
SHA19a9309e3681daa8f7c7b242a8ff759d451ec3362
SHA256c4566a6e135002f097a2dfa8c1e3a4fb39317aa51533d6a2cbc8d509db3e10c5
SHA51209328390650cc0f82bd62e91e9eaa39a5de67c41d79b2214b6cac9456c1b52d7acf559ad261b9e6be32574664ec2e5006145f9890fe8fe4aecab65739615c955
-
Filesize
91KB
MD5792836912149e7543c3b93d11bcbd6b8
SHA14493be6a17526680d7f8d2b5223949eae15d5507
SHA25676500efcf521f1d14ca9db77533f6ddb39a7cebc947e7bbce52f52db22ac1511
SHA512adbca943c4ad544e6c9e7a8e1d40d70c389133bc77b824c678b8f3c1e4d322f38818b2676acc377c7689f4a845d3c814b13bd67e141d6b4a29991ac779f42ddb
-
Filesize
91KB
MD5792836912149e7543c3b93d11bcbd6b8
SHA14493be6a17526680d7f8d2b5223949eae15d5507
SHA25676500efcf521f1d14ca9db77533f6ddb39a7cebc947e7bbce52f52db22ac1511
SHA512adbca943c4ad544e6c9e7a8e1d40d70c389133bc77b824c678b8f3c1e4d322f38818b2676acc377c7689f4a845d3c814b13bd67e141d6b4a29991ac779f42ddb
-
Filesize
91KB
MD5e95449795001a4df1d0fa5aa89d870f5
SHA1b82f562e9679a99ccb29056b343ac2b25acd1ad1
SHA256896d08a09bc70c031881e1d9d9ed7f7f5f50300d143c394a13bdc3664571cf6f
SHA512bd8304f031671ce861b834051f419089a764b9704911d3d8f6e4dcf7b2681073450d9ff5aa896566a1f794b1221706811a5c44d7d8e4f36fa083cbaf492328fb
-
Filesize
91KB
MD5e95449795001a4df1d0fa5aa89d870f5
SHA1b82f562e9679a99ccb29056b343ac2b25acd1ad1
SHA256896d08a09bc70c031881e1d9d9ed7f7f5f50300d143c394a13bdc3664571cf6f
SHA512bd8304f031671ce861b834051f419089a764b9704911d3d8f6e4dcf7b2681073450d9ff5aa896566a1f794b1221706811a5c44d7d8e4f36fa083cbaf492328fb
-
Filesize
91KB
MD5eff8f677df49807333c3ed9c83883948
SHA1b6de1458fd7b5f53bf5b166abbce31d1b9957de7
SHA2562973dc6576235fb161d0fe13107af8fea093f470c0fc4384be779046dc56ffd1
SHA5122532ca8e90515d3851403d731c91ca14f8a81d64aea00cf292227a2971685fd5b99c36bf93518a90f6e57ed2e9286c7597ebe964431eb1b724f27231a2aa115c
-
Filesize
91KB
MD5eff8f677df49807333c3ed9c83883948
SHA1b6de1458fd7b5f53bf5b166abbce31d1b9957de7
SHA2562973dc6576235fb161d0fe13107af8fea093f470c0fc4384be779046dc56ffd1
SHA5122532ca8e90515d3851403d731c91ca14f8a81d64aea00cf292227a2971685fd5b99c36bf93518a90f6e57ed2e9286c7597ebe964431eb1b724f27231a2aa115c