Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 01:32
Static task
static1
Behavioral task
behavioral1
Sample
0a2b01b67a4a45da6bc934058c5e5751.exe
Resource
win7-20231129-en
General
-
Target
0a2b01b67a4a45da6bc934058c5e5751.exe
-
Size
21KB
-
MD5
0a2b01b67a4a45da6bc934058c5e5751
-
SHA1
aa08cee0593a35a7225969863e15efea8e516f27
-
SHA256
de75afcf7668eee9f206b620c4c85cc5f35a23fb707828eb9d2d82241783f24b
-
SHA512
9e8f2a0dd2906525c7640f19110ed4d0b726a97a05a64d4e463362c3319eae0946ec4cfcef444d4b4b8f17b2c21847d99ea206369bdba4904b9c09ef298401e9
-
SSDEEP
384:6VI3+EdgavvxVcxjusw/v3wnOzgcZXxmfnds8US/zkw91AEfHdb:66+a7vxGgswH3wiBXWsLozkUAEfHd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2908 explorer.exe -
Loads dropped DLL 1 IoCs
pid Process 3032 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 5 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0CF76A8C-B122-49DA-8E37-642E97A5D85C} regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\g.dll 0a2b01b67a4a45da6bc934058c5e5751.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2924 set thread context of 2908 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 29 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\MyCLSID = 8c6af70c22b1da498e37642e97a5d85c regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\LastConfigDownload = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal 0a2b01b67a4a45da6bc934058c5e5751.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main 0a2b01b67a4a45da6bc934058c5e5751.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\ConfigUpdate = 687474703a2f2f36392e35302e3137332e3136342f6164762f3239332f73702f6765745f636f6e662e706870 0a2b01b67a4a45da6bc934058c5e5751.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\BinaryCache regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\vars-normal\ConfigUpdate = 687474703a2f2f36392e35302e3137332e3136342f6164762f3239332f73702f6765745f636f6e662e7068706500 regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\InprocServer32\ = "C:\\Windows\\SysWow64\\g.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CF76A8C-B122-49DA-8E37-642E97A5D85C}\ regsvr32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3032 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 28 PID 2924 wrote to memory of 3032 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 28 PID 2924 wrote to memory of 3032 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 28 PID 2924 wrote to memory of 3032 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 28 PID 2924 wrote to memory of 3032 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 28 PID 2924 wrote to memory of 3032 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 28 PID 2924 wrote to memory of 3032 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 28 PID 2924 wrote to memory of 2908 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 29 PID 2924 wrote to memory of 2908 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 29 PID 2924 wrote to memory of 2908 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 29 PID 2924 wrote to memory of 2908 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 29 PID 2924 wrote to memory of 2908 2924 0a2b01b67a4a45da6bc934058c5e5751.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a2b01b67a4a45da6bc934058c5e5751.exe"C:\Users\Admin\AppData\Local\Temp\0a2b01b67a4a45da6bc934058c5e5751.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\system32\g.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:3032
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Deletes itself
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD55d4645be5ca0c5f7551322de73fe14c3
SHA14c8f94944f77d9befcc7440ab124af1eb1f94593
SHA256f381a2d43c722e53eb376e69e65624ef41c8ab89dd30359e97d50a706a11d0dc
SHA512e0853a4d416552b3e03dd5406f71570571c04e41c69e75af558b8f2844655cd65f1034077f4994a27581d4d09784c3e7c7c7dc45b6b29ad92ed6a5baed02c1b5