Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
200s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 05:19
Static task
static1
Behavioral task
behavioral1
Sample
0fd9de7ade782e98932527224de8190d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0fd9de7ade782e98932527224de8190d.exe
Resource
win10v2004-20231215-en
General
-
Target
0fd9de7ade782e98932527224de8190d.exe
-
Size
13KB
-
MD5
0fd9de7ade782e98932527224de8190d
-
SHA1
77a3599c64b13b7848d876f431e6ed438d5f1eeb
-
SHA256
b658e2e642ebcc72efdc36341a604252703231db7a59ed85463eac8fb8be34f7
-
SHA512
304176f5dda65b7c8cf9364b61399cd0902edd22440ab40584c33658bcb24969b6d7d612fe209811a5ca2658055458d29d33350eff3e5962a16a3f6f436aaa3b
-
SSDEEP
384:DxmI6AoJtteqexodGcuudFOvmRr4qHB+v:9mLtteVxrNud8vm9nHB+v
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\cliconfgzx.dll = "{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}" 0fd9de7ade782e98932527224de8190d.exe -
Loads dropped DLL 1 IoCs
pid Process 3492 0fd9de7ade782e98932527224de8190d.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\cliconfgzx.tmp 0fd9de7ade782e98932527224de8190d.exe File opened for modification C:\Windows\SysWOW64\cliconfgzx.tmp 0fd9de7ade782e98932527224de8190d.exe File opened for modification C:\Windows\SysWOW64\cliconfgzx.nls 0fd9de7ade782e98932527224de8190d.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07} 0fd9de7ade782e98932527224de8190d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32 0fd9de7ade782e98932527224de8190d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ = "C:\\Windows\\SysWow64\\cliconfgzx.dll" 0fd9de7ade782e98932527224de8190d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ThreadingModel = "Apartment" 0fd9de7ade782e98932527224de8190d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3492 0fd9de7ade782e98932527224de8190d.exe 3492 0fd9de7ade782e98932527224de8190d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3492 0fd9de7ade782e98932527224de8190d.exe 3492 0fd9de7ade782e98932527224de8190d.exe 3492 0fd9de7ade782e98932527224de8190d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3492 wrote to memory of 2796 3492 0fd9de7ade782e98932527224de8190d.exe 96 PID 3492 wrote to memory of 2796 3492 0fd9de7ade782e98932527224de8190d.exe 96 PID 3492 wrote to memory of 2796 3492 0fd9de7ade782e98932527224de8190d.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d.exe"C:\Users\Admin\AppData\Local\Temp\0fd9de7ade782e98932527224de8190d.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\39B4.tmp.bat2⤵PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD5c5052b4f704d3e867d11cac3a098273b
SHA1c97e5e70b8a0d87957571c13662e6fce2df49a0a
SHA256abf29a30bfa0c3053e6fa13b560cb981ebb791d3e9415e3826df1ce2f8f2ea90
SHA51257b75651527c2d501d67425790f1443014db1e14308c2b9e3f8bf67ee1413e9b2b7f13c0525530996d598cc07cede29d963ec0886ba826f49d2fc2dbda909593
-
Filesize
84KB
MD57e1a504108510946ba8d0b9512983a45
SHA10263429fbdf38ff718b574b90de92131684bf175
SHA25615913afd464922ec4fbfa2766c7f5f7fb788072ca791c441f74902aaf590e3c5
SHA512c0eb157690a2d0a615fad86371d29bbf8017a90cdc1b9eb5c711c746c727fe7c8d0bd5c31c2da701ee0d56aa6c5a4d7ee0f571c9f7ec4f8fd3adb25dbba0b3bf
-
Filesize
196KB
MD53affe03ef69a67ea5246cc116af5e95a
SHA19e404bf792676908b697a47fce52bd63ab6ee0d6
SHA256c6b19bf400048d45f97cb4f57b9674bb1d4f454174fa0224ab9c7b212f7fc4ba
SHA512ddb458401040e77d45ffe618549e212c128ac95b9c0f9b898ab4c395bc1f6775c2eda7dbf2d4483c48d87b1b77da4b735e198adb5bb57438f01573bf6d423417