Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:10
Behavioral task
behavioral1
Sample
053ecfe44a3f026cd57ca947ba0cbf0a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
053ecfe44a3f026cd57ca947ba0cbf0a.exe
Resource
win10v2004-20231222-en
General
-
Target
053ecfe44a3f026cd57ca947ba0cbf0a.exe
-
Size
37KB
-
MD5
053ecfe44a3f026cd57ca947ba0cbf0a
-
SHA1
27787448de35b99874c9f4f227fa2b4c797640bb
-
SHA256
e22e081c5e641cbc0021100f184db29fa1cb0d55e7ced2ad1e9f9b5930a4ff62
-
SHA512
fa3c98a5e5ef523303141c7bda879ed12c007f0a6199da2c5bbc073fca82c3fa6f0b86ef60ec7dc803da9b193538b6a59b6149daa3cddd75766ef9caaa03839c
-
SSDEEP
768:RVGh82aiMC41JuGIdkJmPEGxm+A/0WXMSCnIID3+:y8Nn1oGiwO9B7WXRk+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\sochost.exe" 053ecfe44a3f026cd57ca947ba0cbf0a.exe -
Deletes itself 1 IoCs
pid Process 828 kaceyl.exe -
Executes dropped EXE 3 IoCs
pid Process 2776 sschost.exe 828 kaceyl.exe 2576 sochost.exe -
Loads dropped DLL 12 IoCs
pid Process 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 828 kaceyl.exe 828 kaceyl.exe 828 kaceyl.exe 2808 regsvr32.exe 828 kaceyl.exe 828 kaceyl.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe -
resource yara_rule behavioral1/memory/2856-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2856-1-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2856-23-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/files/0x00070000000167c9-34.dat upx behavioral1/memory/2576-45-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2576-49-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{10FDCE1E-C36A-474E-808E-248C51693DB7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{10FDCE1E-C36A-474E-808E-248C51693DB7}\ = "Accounts Manager" regsvr32.exe -
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\kavlec.sys 053ecfe44a3f026cd57ca947ba0cbf0a.exe File created C:\Windows\SysWOW64\ssdtt.sys 053ecfe44a3f026cd57ca947ba0cbf0a.exe File created C:\Windows\SysWOW64\kaceyl.exe 053ecfe44a3f026cd57ca947ba0cbf0a.exe File created C:\Windows\SysWOW64\kavsul.dll 053ecfe44a3f026cd57ca947ba0cbf0a.exe File created C:\Windows\SysWOW64\macsoin.dll 053ecfe44a3f026cd57ca947ba0cbf0a.exe File opened for modification C:\Windows\SysWOW64\sochost.exe kaceyl.exe File opened for modification C:\Windows\SysWOW64\winsys.ini kaceyl.exe File created C:\Windows\SysWOW64\sschost.exe 053ecfe44a3f026cd57ca947ba0cbf0a.exe File created C:\Windows\SysWOW64\kavsus.dll 053ecfe44a3f026cd57ca947ba0cbf0a.exe File created C:\Windows\SysWOW64\sochost.exe kaceyl.exe File opened for modification C:\Windows\SysWOW64\winsys.ini 053ecfe44a3f026cd57ca947ba0cbf0a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\TypeLib\ = "{930E11EA-3A91-4FBB-B141-DC53DF650DFF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\ProgID\ = "CKBHO_2.BHO.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\ = "CKBHO_2 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO\ = "Accounts Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\ = "Accounts Manager" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\ = "IBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO\CLSID\ = "{10FDCE1E-C36A-474E-808E-248C51693DB7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\InprocServer32\ = "C:\\Windows\\SysWow64\\kavsus.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\kavsus.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\TypeLib\ = "{930E11EA-3A91-4FBB-B141-DC53DF650DFF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO.1\CLSID\ = "{10FDCE1E-C36A-474E-808E-248C51693DB7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\TypeLib\ = "{930E11EA-3A91-4FBB-B141-DC53DF650DFF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO.1\ = "Accounts Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\ = "IBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{365676AB-E92E-4D87-A735-17AEE185E0E1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{930E11EA-3A91-4FBB-B141-DC53DF650DFF}\1.0\HELPDIR\ = "C:\\Windows\\system32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CKBHO_2.BHO\CurVer\ = "CKBHO_2.BHO.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10FDCE1E-C36A-474E-808E-248C51693DB7}\VersionIndependentProgID\ = "CKBHO_2.BHO" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe 2576 sochost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSystemtimePrivilege 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe Token: SeSystemtimePrivilege 2576 sochost.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 2776 sschost.exe 2776 sschost.exe 828 kaceyl.exe 2576 sochost.exe 2576 sochost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2776 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 28 PID 2856 wrote to memory of 2776 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 28 PID 2856 wrote to memory of 2776 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 28 PID 2856 wrote to memory of 2776 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 28 PID 2856 wrote to memory of 2808 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 29 PID 2856 wrote to memory of 2808 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 29 PID 2856 wrote to memory of 2808 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 29 PID 2856 wrote to memory of 2808 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 29 PID 2856 wrote to memory of 2808 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 29 PID 2856 wrote to memory of 2808 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 29 PID 2856 wrote to memory of 2808 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 29 PID 2856 wrote to memory of 828 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 30 PID 2856 wrote to memory of 828 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 30 PID 2856 wrote to memory of 828 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 30 PID 2856 wrote to memory of 828 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 30 PID 2856 wrote to memory of 828 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 30 PID 2856 wrote to memory of 828 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 30 PID 2856 wrote to memory of 828 2856 053ecfe44a3f026cd57ca947ba0cbf0a.exe 30 PID 828 wrote to memory of 2576 828 kaceyl.exe 31 PID 828 wrote to memory of 2576 828 kaceyl.exe 31 PID 828 wrote to memory of 2576 828 kaceyl.exe 31 PID 828 wrote to memory of 2576 828 kaceyl.exe 31 PID 828 wrote to memory of 2576 828 kaceyl.exe 31 PID 828 wrote to memory of 2576 828 kaceyl.exe 31 PID 828 wrote to memory of 2576 828 kaceyl.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\053ecfe44a3f026cd57ca947ba0cbf0a.exe"C:\Users\Admin\AppData\Local\Temp\053ecfe44a3f026cd57ca947ba0cbf0a.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\sschost.exe"C:\Windows\system32\sschost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /c C:\Windows\system32\kavsus.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2808
-
-
C:\Windows\SysWOW64\kaceyl.exe"C:\Windows\system32\kaceyl.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\sochost.exe"C:\Windows\system32\sochost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f8ecd47e116c0c6304ba7a652bd7cbd4
SHA1522e7efc1cef4e790d88b97b2524b43a071413e1
SHA256afd36c473f8f7c83da46f27d86fae04beef761a3321bdd5a731afddfd4a2e546
SHA51276535b41926c4d7b54b8ca5e8aeec91b6b18d87f26d7cea5691540905ca2818dc331df41be185399aac9ae1568f22d300c1c08df159d405b623b4caf023abe35
-
Filesize
91B
MD5176db116c4fdf1f17e781f1848b8be66
SHA1d760d66f88e41e740c4a6d021daf1a15dbd2c0bb
SHA256581b950d947e387f6a8192bb7f835b2b7e4549343e58b54c9e859957062b8752
SHA512b68b577050fe1c2c6cae663d21b452aa07edb3f716bc3183af466deff18b816d9b198f22c582d906ceecab2726b017453090b80cedd3982c404d98bb2b2b9172
-
Filesize
26B
MD5d8ab3ea023fda33b8017ccc4748534f8
SHA1e5c8b0f40ed03ad98f0d207ee073af2ee925db78
SHA25614776c2d9c1446833752ec1c0686cc74bee4c3bd3036b3ad7cf51249ebe381ab
SHA5120a6ab8641e77dcdc9b33e49462404aaf43ca549122d6fd5afc72448b5f50558859657d64d66d38415e752c05abaa225e545310986516eb1af0f691ff690ec5e0
-
Filesize
20KB
MD54a6a030b4c32ebc79e600d9c475047e1
SHA1b5d79f4f6ed357b3ea3a0b9aae968ae5718b0f4a
SHA256f94890e9c92b55944e7e81fdc4f7f701c398dba0fd5a7298d959a4f07e9df2c7
SHA5120d1d30a0a75c29d0de40e187873340c175c3118c5cb574efff80186fe56f7e5a98ee9876faa55300d5cd7aed4d974d9d96eadbed77e1043fcc89c64124df04ff
-
Filesize
32KB
MD5d6be87c92881df32d1b96fba57fcc369
SHA168c86111f62756c9499f0cef99d53f29392a76a0
SHA25663eb609bda077a86601d6982561cbb7d0b0422cfe9a82d2b2e15247adc0ffce2
SHA51270620a637346b5682540a8ea8e1585f4ebe4e8d61683dd1f839613002a8575a4e3d18938d5216da9805109601520f110f6f00cff978f634932eb5bfb8b3a727d
-
Filesize
37KB
MD5053ecfe44a3f026cd57ca947ba0cbf0a
SHA127787448de35b99874c9f4f227fa2b4c797640bb
SHA256e22e081c5e641cbc0021100f184db29fa1cb0d55e7ced2ad1e9f9b5930a4ff62
SHA512fa3c98a5e5ef523303141c7bda879ed12c007f0a6199da2c5bbc073fca82c3fa6f0b86ef60ec7dc803da9b193538b6a59b6149daa3cddd75766ef9caaa03839c
-
Filesize
20KB
MD571e241d422dab0aa95b0e222074faaf4
SHA161fbb443bee657bf1fb4628a96fa123a989c13a4
SHA25689fc8a546f5551f27d5e6b5216555f967d387011a92f0cfd9400b5c58d208721
SHA5124d4986ed3a46ae042bcd20aa455ca4932d17d73584c30c19a2e2bc29e279d36493ae42d4caf8429eaadb92ddd4c3f58c019203ec33c99e8b622c363fddd6c472