Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
061690006fccf0d52bf47e8a142a31c9.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
061690006fccf0d52bf47e8a142a31c9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
061690006fccf0d52bf47e8a142a31c9.exe
-
Size
1.4MB
-
MD5
061690006fccf0d52bf47e8a142a31c9
-
SHA1
3343a6d20da69c74643fa9af14b3b784bdeb20f8
-
SHA256
60ea7fc78d4db83ab17674ae41a98d19d000bb939248dd5bd6f12524877a3d42
-
SHA512
5ece061a2ad25ec2ddd294302b4a97517e5010af6c13bd38acd6aae72cdaf92abd0cca0610e81d713bc6511c4490397f9bfca3b3aaab4280d56a7dfc84401233
-
SSDEEP
24576:3utr5OULQaKYOAa/Q7lhRugqqnMx5OKASgL7sg1MMbo3O5X1UhmA7Ji1BWYk:3uXJx9C8PggXMx5OKmQxMbo3OtawAdie
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2584 bstrapInstall.exe -
Loads dropped DLL 7 IoCs
pid Process 1716 061690006fccf0d52bf47e8a142a31c9.exe 2584 bstrapInstall.exe 2584 bstrapInstall.exe 2584 bstrapInstall.exe 1816 regsvr32.exe 1816 regsvr32.exe 1816 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerDlg.InstallDlgCtl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl\CLSID\ = "{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl\CurVer\ = "StubbyUtil.ShellCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl.1\ = "CShellCtl Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl.1\CLSID\ = "{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\TypeLib\ = "{12631F96-F37E-4975-81D5-16E871EE557B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\bin\\InstallerDlg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\InprocServer32\ThreadingModel = "both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\TypeLib\ = "{12631F96-F37E-4975-81D5-16E871EE557B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\InprocServer32\ThreadingModel = "both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerDlg.InstallDlgCtl\ = "CInstallDlgCtl Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerDlg.InstallDlgCtl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\ProgID\ = "StubbyUtil.ShellCtl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\VersionIndependentProgID\ = "StubbyUtil.ShellCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\VersionIndependentProgID\ = "InstallerDlg.InstallDlgCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl\ = "CShellCtl Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\StubbyUtil.ShellCtl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerDlg.InstallDlgCtl\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerDlg.InstallDlgCtl\CLSID\ = "{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InstallerDlg.InstallDlgCtl\CurVer\ = "InstallerDlg.InstallDlgCtl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\ = "CInstallDlgCtl Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\ = "CShellCtl Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B5C103F-DAAF-425E-B3A9-DEDE61F3A6F4}\ProgID\ = "InstallerDlg.InstallDlgCtl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RarSFX0\\bin\\InstallerDlg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AB3FB6-9660-416C-BE8D-0E2E8AC3138B}\AppID regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1716 061690006fccf0d52bf47e8a142a31c9.exe Token: SeRestorePrivilege 1716 061690006fccf0d52bf47e8a142a31c9.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2584 1716 061690006fccf0d52bf47e8a142a31c9.exe 27 PID 1716 wrote to memory of 2584 1716 061690006fccf0d52bf47e8a142a31c9.exe 27 PID 1716 wrote to memory of 2584 1716 061690006fccf0d52bf47e8a142a31c9.exe 27 PID 1716 wrote to memory of 2584 1716 061690006fccf0d52bf47e8a142a31c9.exe 27 PID 1716 wrote to memory of 2584 1716 061690006fccf0d52bf47e8a142a31c9.exe 27 PID 1716 wrote to memory of 2584 1716 061690006fccf0d52bf47e8a142a31c9.exe 27 PID 1716 wrote to memory of 2584 1716 061690006fccf0d52bf47e8a142a31c9.exe 27 PID 2584 wrote to memory of 1816 2584 bstrapInstall.exe 20 PID 2584 wrote to memory of 1816 2584 bstrapInstall.exe 20 PID 2584 wrote to memory of 1816 2584 bstrapInstall.exe 20 PID 2584 wrote to memory of 1816 2584 bstrapInstall.exe 20 PID 2584 wrote to memory of 1816 2584 bstrapInstall.exe 20 PID 2584 wrote to memory of 1816 2584 bstrapInstall.exe 20 PID 2584 wrote to memory of 1816 2584 bstrapInstall.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\061690006fccf0d52bf47e8a142a31c9.exe"C:\Users\Admin\AppData\Local\Temp\061690006fccf0d52bf47e8a142a31c9.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\bstrapInstall.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\bstrapInstall.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s .\bin\InstallerDlg.dll1⤵
- Loads dropped DLL
- Modifies registry class
PID:1816
-
C:\Program Files (x86)\RealArcade\Installer\bin\bstrapInstall.exe"C:\Program Files (x86)\RealArcade\Installer\bin\bstrapInstall.exe" sfx:"C:\Users\Admin\AppData\Local\Temp\061690006fccf0d52bf47e8a142a31c9.exe"1⤵PID:1292
-
C:\Program Files (x86)\RealArcade\Installer\bin\gameinstaller.exe.\bin\gameinstaller.exe installerMain.clf "sfx:C:\Users\Admin\AppData\Local\Temp\061690006fccf0d52bf47e8a142a31c9.exe"2⤵PID:1896
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s "bin\GCHROME.dll"3⤵PID:908
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s .\bin\InstallerDlg.dll2⤵PID:776
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\bin\gameinstaller.exe.\bin\gameinstaller.exe installerMain.clf1⤵PID:1692