Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
437c490013741910e7a5b4445279416c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
437c490013741910e7a5b4445279416c.exe
Resource
win10v2004-20231222-en
General
-
Target
437c490013741910e7a5b4445279416c.exe
-
Size
757KB
-
MD5
437c490013741910e7a5b4445279416c
-
SHA1
f8477cb2836411d1add6fc7ce55fed1d61624310
-
SHA256
5ab9966ab866322419e23ca16e5896f09c11d5fc015b5df584868ae38c1409bd
-
SHA512
741774e50624ce655bec9e4e162954e23dd50cdc042652e6877a86295ed70badba960d375039b14fa6de4e6e217bf2fcb421461eacb28ea8003f5e2940c7eb2e
-
SSDEEP
12288:njXipx70Np/Z9xwy/bAHmdtYpkzz84cNZcu0uAimaLV+qvTOHsGiE:jX1/PWy/bAHmdWpCYNGu0emaZXqHsGi
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x002f000000015d81-19.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2672 437c490013741910e7a5b4445279416c.exe -
Loads dropped DLL 3 IoCs
pid Process 2364 437c490013741910e7a5b4445279416c.exe 2364 437c490013741910e7a5b4445279416c.exe 2672 437c490013741910e7a5b4445279416c.exe -
resource yara_rule behavioral1/memory/2672-21-0x0000000001DB0000-0x0000000001DC1000-memory.dmp upx behavioral1/files/0x002f000000015d81-19.dat upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srtserv = "C:\\ProgramData\\srtserv\\437c490013741910e7a5b4445279416c.exe" 437c490013741910e7a5b4445279416c.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 37 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000008f5708711100557365727300600008000400efbeee3a851a8f5708712a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000025580f56102054656d700000360008000400efbe8f57087125580f562a000000ff010000000002000000000000000000000000000000540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000008f57a773100041646d696e00380008000400efbe8f5708718f57a7732a00000031000000000003000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 860031000000000025580f5617003433374334397e3100006e0008000400efbe25580f5625580f562a0000005122010000000b00000000000000000000000000000034003300370063003400390030003000310033003700340031003900310030006500370061003500620034003400340035003200370039003400310036006300000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000008f570871122041707044617461003c0008000400efbe8f5708718f5708712a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000008f57337210204c6f63616c00380008000400efbe8f5708718f5733722a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000 explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2672 437c490013741910e7a5b4445279416c.exe 2672 437c490013741910e7a5b4445279416c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 437c490013741910e7a5b4445279416c.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2372 2364 437c490013741910e7a5b4445279416c.exe 30 PID 2364 wrote to memory of 2372 2364 437c490013741910e7a5b4445279416c.exe 30 PID 2364 wrote to memory of 2372 2364 437c490013741910e7a5b4445279416c.exe 30 PID 2364 wrote to memory of 2372 2364 437c490013741910e7a5b4445279416c.exe 30 PID 2364 wrote to memory of 2672 2364 437c490013741910e7a5b4445279416c.exe 29 PID 2364 wrote to memory of 2672 2364 437c490013741910e7a5b4445279416c.exe 29 PID 2364 wrote to memory of 2672 2364 437c490013741910e7a5b4445279416c.exe 29 PID 2364 wrote to memory of 2672 2364 437c490013741910e7a5b4445279416c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\437c490013741910e7a5b4445279416c.exe"C:\Users\Admin\AppData\Local\Temp\437c490013741910e7a5b4445279416c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\ProgramData\srtserv\437c490013741910e7a5b4445279416c.exeC:\ProgramData\srtserv\437c490013741910e7a5b4445279416c.exe -wait2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\437c490013741910e7a5b4445279416c2⤵PID:2372
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD5385cd9ae9574aaa10f37b5d515fcdd6c
SHA1f0a5f89fecc5b8f233d60099b37d6b2770e3b23a
SHA2568ce73b8225ab4ca21998cb1fb9d5b8fd26ce221b1dafc5e340febd7aaa630047
SHA512accc7566b571e74d78876e87eb413926afe1cff091230b579d1ed20548c0120b0288359795f3d0d20bc543c4e9447a849e69b2e4599399b9c4a7888a55690784
-
Filesize
757KB
MD5437c490013741910e7a5b4445279416c
SHA1f8477cb2836411d1add6fc7ce55fed1d61624310
SHA2565ab9966ab866322419e23ca16e5896f09c11d5fc015b5df584868ae38c1409bd
SHA512741774e50624ce655bec9e4e162954e23dd50cdc042652e6877a86295ed70badba960d375039b14fa6de4e6e217bf2fcb421461eacb28ea8003f5e2940c7eb2e
-
Filesize
23KB
MD54a68bdeb219f697115c035d5f7000ee4
SHA19b3e7baaceb706b5d4f3c682806a7e27603b32f2
SHA256c505c9c35bc24243aabea8e349145c9dbff2da2ca6567fe2f750d887cc3cc27d
SHA512b9305d262d08171df9b7c8f937c328953ce84b621cdf37ffc74b27d84f1bf364460dc6d4da40dbb94317980699fca8b7b8a9a58a409db74baba81546b0253a34