Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 08:04
Static task
static1
Behavioral task
behavioral1
Sample
7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe
Resource
win10v2004-20230915-en
General
-
Target
7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe
-
Size
79KB
-
MD5
e06f2e989fad7db423ef3d9ba314276d
-
SHA1
e1c9173ffbb74a2fe54a67e1dc5c5611a7bfda07
-
SHA256
7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e
-
SHA512
75e5094d026eb1893d2b318b8334b6162aaf9d19bb5b802d6f5e101c2b1be5b63affcb5166e01aba50b5262a552c7d7197d3fddb7b5a782890f5dbd90cb3d8af
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOy69G:GhfxHNIreQm+Hiz69G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2056 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe File created C:\Windows\SysWOW64\¢«.exe 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe File created C:\Windows\system\rundll32.exe 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1697023958" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1697023958" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2056 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 2056 rundll32.exe 2056 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2056 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 86 PID 4920 wrote to memory of 2056 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 86 PID 4920 wrote to memory of 2056 4920 7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe"C:\Users\Admin\AppData\Local\Temp\7c3a3379be3690bc4712d6b0960653df729684976f03cf0ec3328856fbad366e.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5004ea4d849ef6f626527ef2721f1170f
SHA12abcb0b17c17cbf81b2e5326ee9de0231eaa5d9c
SHA25603eb2ab923f6fd72173673c4373b6a53c013807c89625c8faf77d77dbdcbafdd
SHA512042c9c67b0015a7aee5e8d78d8c5e7b774036d94651893890704d91f83d2c984fbbf14b0d71124c374c7b0a7fbac956b9845f10c63ae29e8a0080bb6d160a9ca
-
Filesize
81KB
MD5b9b5d77175a767f0712a1312671a8552
SHA11646be2882acbadd0a4df81e051ea4a518d6a615
SHA25638698789b0e58f7e4f4923eec3d060e65b4c0b697fb8c3ac21d58f0d92dc8839
SHA512b763773831d8239786c485d1da96b9897afcd7ef6e9f930ea4e58f0c776331eae21b7e9d626fb504806fdaa7438750cf6b36c36cf10e0e609de356c4411afc36
-
Filesize
81KB
MD5b9b5d77175a767f0712a1312671a8552
SHA11646be2882acbadd0a4df81e051ea4a518d6a615
SHA25638698789b0e58f7e4f4923eec3d060e65b4c0b697fb8c3ac21d58f0d92dc8839
SHA512b763773831d8239786c485d1da96b9897afcd7ef6e9f930ea4e58f0c776331eae21b7e9d626fb504806fdaa7438750cf6b36c36cf10e0e609de356c4411afc36