Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
49ca85dbd5095b14997e7a22c36ce5e1.exe
Resource
win7-20231215-en
General
-
Target
49ca85dbd5095b14997e7a22c36ce5e1.exe
-
Size
245KB
-
MD5
49ca85dbd5095b14997e7a22c36ce5e1
-
SHA1
c2d98f85b0cb72173dc01cca1bce491ea572dfff
-
SHA256
5cbb7af1ab7f0d8de6026001ea504da34d5ab917eca99d3285eab59f67f3177f
-
SHA512
33203bc02aea4f3c48b08b4b758c14761e9b92c5a2949150950c070846a4a29eb9337d256bcbcbc46d3ab8cf3c8e80044572cbe14e5d97735bafc21919cc774a
-
SSDEEP
6144:h1OgDPdkBAFZWjadD4s55gL0WRPl5a1hRYpBuVnW:h1OgLdaOIFraG+nW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1976 5073e05a4220a.exe -
Loads dropped DLL 3 IoCs
pid Process 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 1976 5073e05a4220a.exe 1976 5073e05a4220a.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7623C192-C3FE-549D-0144-1571B1716396} 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7623C192-C3FE-549D-0144-1571B1716396}\ = "wxDownload" 5073e05a4220a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7623C192-C3FE-549D-0144-1571B1716396}\NoExplorer = "1" 5073e05a4220a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0007000000014703-13.dat nsis_installer_1 behavioral1/files/0x0007000000014703-13.dat nsis_installer_2 -
Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx.4\CLSID\ = "{7623C192-C3FE-549D-0144-1571B1716396}" 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\InprocServer32\ = "C:\\ProgramData\\wxDownload\\5073e05a42243.ocx" 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\Programmable 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx.4\CLSID 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx\CLSID 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396} 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx\CurVer 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\InprocServer32\ThreadingModel = "Apartment" 5073e05a4220a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\InprocServer32 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\InprocServer32 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx.4\ = "wxDownload" 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx\CurVer\ = "5073e05a42243.ocx.4" 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\ProgID 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx\CLSID\ = "{7623C192-C3FE-549D-0144-1571B1716396}" 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\ProgID\ = "5073e05a42243.ocx.4" 5073e05a4220a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\ProgID 5073e05a4220a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\Programmable 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\ = "wxDownload Class" 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\VersionIndependentProgID 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\VersionIndependentProgID\ = "5073e05a42243.ocx" 5073e05a4220a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396}\VersionIndependentProgID 5073e05a4220a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7623C192-C3FE-549D-0144-1571B1716396} 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx.4 5073e05a4220a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx 5073e05a4220a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\5073e05a42243.ocx.5073e05a42243.ocx\ = "wxDownload" 5073e05a4220a.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1976 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 14 PID 1192 wrote to memory of 1976 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 14 PID 1192 wrote to memory of 1976 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 14 PID 1192 wrote to memory of 1976 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 14 PID 1192 wrote to memory of 1976 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 14 PID 1192 wrote to memory of 1976 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 14 PID 1192 wrote to memory of 1976 1192 49ca85dbd5095b14997e7a22c36ce5e1.exe 14
Processes
-
C:\Users\Admin\AppData\Local\Temp\7zSA5D.tmp\5073e05a4220a.exe.\5073e05a4220a.exe /s1⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1976
-
C:\Users\Admin\AppData\Local\Temp\49ca85dbd5095b14997e7a22c36ce5e1.exe"C:\Users\Admin\AppData\Local\Temp\49ca85dbd5095b14997e7a22c36ce5e1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD54ccf1a317aa8539c857835e4ebe9c806
SHA1223b73d09d7398f40aff3ccc569e66cae3886ee9
SHA2564529889c5575cd4e28b3691f0489c806442840292a9e459ada4dab3e024cc242
SHA512ecab68799b5a51c7d2a3735a9b3c17ba20a315618aa9575a5b02d5d4535716966031a26982012669f069dbfd8a6ab62f95737b7c402bf680f3a498900f627312
-
Filesize
4KB
MD5a23c3c0f55c7572a14ed3c3d1767ac38
SHA1cb169db17be884b2a51e6569accb70413826c500
SHA25611f199c534034d7e94d95b21bb8adbff654880cdd2afdb231574c89e2ddbe16a
SHA512db75ea1827e6461b3999d188e635c7d8e74b670a97f8cc889c3b37028819e7d516d821f0159e9ce105286e5b9b5acfb8c86b4f153ae0ad5b46335883656a2758
-
Filesize
753B
MD54526fe6d4925e4284dbc8fe2f077a4be
SHA165eee3a6a7c2bc875f22f2ddcc9124a002af7204
SHA25610a59b99552d259a16e8e97e2cc20d75fc33fa8392d4c9da4acd27de71d586c8
SHA51272e4d8cc38014a4bc6e59110883d5b3ee624afb80cc433c26c8ff5d512697e042570cc034e1a57289b8ae24635b2fb20f528736600713ff1783bc1ea4b464558
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b