Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
055649e38b0aedfe39fa9c1c659b7f4b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
055649e38b0aedfe39fa9c1c659b7f4b.exe
Resource
win10v2004-20231215-en
General
-
Target
055649e38b0aedfe39fa9c1c659b7f4b.exe
-
Size
954KB
-
MD5
055649e38b0aedfe39fa9c1c659b7f4b
-
SHA1
0f457ced6af51864b1f66778a97fd5fad7d1b7e0
-
SHA256
d1a1dea28ddb29acd76e1e1f1f3f07496ca4fe569f0a6de0d2d998c10682e030
-
SHA512
66a362ede3336711a56b6b32a974cf221a5257cc749d72704a5a9309c47294cfacbdf0e6042654e762dacd3e673bda708b7aa61c2f91bb112128879b68a97486
-
SSDEEP
24576:hooS8us2n3hr++Iv+qBYmBKd3PrrTQkrd2Fq82c1xjb1u6qF:5u5sgL3Pit1K5F
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\LocalServer32 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\ = "InstallerLib" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib\Version = "1.0" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\FLAGS 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd} 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\VersionIndependentProgID 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\0 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily\ = "Inst Class" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily\CurVer 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\VersionIndependentProgID 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\LocalServer32 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\TypeLib 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68} 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily.1\ = "Inst Class" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\0\win32 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily.1 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\ProgID\ = "coffered.glumpily.1" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib\Version = "1.0" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily.1\CLSID 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\ProgID 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\0 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily.1 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\Version 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\055649e38b0aedfe39fa9c1c659b7f4b.exe" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68} 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\ = "IBoot" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\HELPDIR 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\FLAGS\ = "0" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd} 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\ = "Inst Class" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\TypeLib 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C} 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\FLAGS 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib\ = "{91C60E3F-7ED3-411C-A77F-6103921C640C}" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\ProxyStubClsid32 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily\CurVer\ = "coffered.glumpily.1" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\055649e38b0aedfe39fa9c1c659b7f4b.exe" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\055649e38b0aedfe39fa9c1c659b7f4b.exe:typelib" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\0\win32 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily\CurVer 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\ = "IBoot" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\055649e38b0aedfe39fa9c1c659b7f4b.exe\"" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0\HELPDIR 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68} 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\Programmable 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\ProxyStubClsid32 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\ProgID 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily 055649e38b0aedfe39fa9c1c659b7f4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\ProxyStubClsid32 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\Programmable 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\Version 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53111B39-39E8-4E9B-A4F5-12CD4750DB68}\TypeLib\ = "{91C60E3F-7ED3-411C-A77F-6103921C640C}" 055649e38b0aedfe39fa9c1c659b7f4b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91C60E3F-7ED3-411C-A77F-6103921C640C}\1.0 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\coffered.glumpily.1\CLSID\ = "{877d86ce-929a-4a70-96e0-36e9e4996cfd}" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\VersionIndependentProgID\ = "coffered.glumpily" 055649e38b0aedfe39fa9c1c659b7f4b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{877d86ce-929a-4a70-96e0-36e9e4996cfd}\TypeLib\ = "{91c60e3f-7ed3-411c-a77f-6103921c640c}" 055649e38b0aedfe39fa9c1c659b7f4b.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\055649e38b0aedfe39fa9c1c659b7f4b.exe:typelib 055649e38b0aedfe39fa9c1c659b7f4b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1104 055649e38b0aedfe39fa9c1c659b7f4b.exe 1104 055649e38b0aedfe39fa9c1c659b7f4b.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b57dbba2c3519f66a451ab4dcb669e0e
SHA106b555d0ce1efa77161209bb7fa1d0d8b7286905
SHA256099adc7994d2f087587c2cbd5cbb991431a28e16e4ca77bdda6792df07683323
SHA512704563ec9d828b7701dbc58ddb3910f5921897374a8128563e9e3b84ef46357cdfa36ff266b87ff6839dd698acf08f629ebaf894888ba659335cac9e07515e96