Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 23:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44abb3e39573a2e1d1cdc787c41bc7ca.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
44abb3e39573a2e1d1cdc787c41bc7ca.exe
-
Size
144KB
-
MD5
44abb3e39573a2e1d1cdc787c41bc7ca
-
SHA1
4800af743c8f6117360aba3ecd4c393d99ff7ba8
-
SHA256
73e9814afae15d32be894cd397ee30391527608368f8f2c4aa71734abf4bfba4
-
SHA512
5be67214070557c0f9f85b3baa36c67d17ee439531e747d726e3f129dee9b39d5d0b217fd21439321a2f98ae27cbf625f497482d22031ecc7e338c1ae00fd0c7
-
SSDEEP
3072:QuYTsR3nSVl8r9rMj7Vmk1Hpv35Q0NgEGQe2wvW:FSW9rEmkZXQJQk
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1976 44abb3e39573a2e1d1cdc787c41bc7ca.exe -
resource yara_rule behavioral1/memory/1976-2-0x0000000000220000-0x0000000000261000-memory.dmp upx behavioral1/memory/1976-3-0x0000000000220000-0x0000000000261000-memory.dmp upx behavioral1/memory/1976-4-0x0000000000220000-0x0000000000261000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3E422F06-FC31-4B35-BD96-28420C76F857} 44abb3e39573a2e1d1cdc787c41bc7ca.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E422F06-FC31-4B35-BD96-28420C76F857}\InprocServer32\ThreadingModel = "apartment" 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E422F06-FC31-4B35-BD96-28420C76F857}\InprocServer32 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E422F06-FC31-4B35-BD96-28420C76F857} 44abb3e39573a2e1d1cdc787c41bc7ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E422F06-FC31-4B35-BD96-28420C76F857}\InprocServer32\ = "C:\\Windows\\SysWow64\\api-ms-win-service-management-l1-1-.dll" 44abb3e39573a2e1d1cdc787c41bc7ca.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1976 44abb3e39573a2e1d1cdc787c41bc7ca.exe