Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
7767584620e59e05a3ae46a34b4d56f6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7767584620e59e05a3ae46a34b4d56f6.exe
Resource
win10v2004-20231215-en
General
-
Target
7767584620e59e05a3ae46a34b4d56f6.exe
-
Size
236KB
-
MD5
7767584620e59e05a3ae46a34b4d56f6
-
SHA1
cd7c8823a74fa3ad6e21b111599f2ac474e8f5c9
-
SHA256
f6b64431b2de8c29d22aa58c2a98460f32c35e704f6598382a401e9cdd8c50bb
-
SHA512
08964a1687cf9c7f7522d25d4423c056063654c5c4f76e95d7a09f58f57640d92defe638ec66936ca76c4c2788f57333915fbefd825e7a64a54e86eda3433c9d
-
SSDEEP
3072:SMW7LAAxh6Xm5wx271h6yAZLUXGvwmvs/2BL9:SMK0U6XwP71h6ykocw8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2992 REGNETJO.EXE 3052 REGNETJO.EXE -
Loads dropped DLL 4 IoCs
pid Process 2940 7767584620e59e05a3ae46a34b4d56f6.exe 2940 7767584620e59e05a3ae46a34b4d56f6.exe 2992 REGNETJO.EXE 2992 REGNETJO.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Regnetjo = "C:\\WINDOWS\\SYSTEM32\\REGNETJO.EXE" 7767584620e59e05a3ae46a34b4d56f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Regnetjo = "C:\\WINDOWS\\SYSTEM32\\REGNETJO.EXE" 7767584620e59e05a3ae46a34b4d56f6.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\REGNETJO.EXE REGNETJO.EXE File created C:\WINDOWS\SysWOW64\REGNETJO.EXE REGNETJO.EXE File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX REGNETJO.EXE File opened for modification C:\Windows\SysWOW64\RICHTX32.OCX REGNETJO.EXE File opened for modification C:\WINDOWS\SysWOW64\REGNETJO.EXE 7767584620e59e05a3ae46a34b4d56f6.exe File created C:\WINDOWS\SysWOW64\REGNETJO.EXE 7767584620e59e05a3ae46a34b4d56f6.exe File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX 7767584620e59e05a3ae46a34b4d56f6.exe File opened for modification C:\Windows\SysWOW64\RICHTX32.OCX 7767584620e59e05a3ae46a34b4d56f6.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2940 7767584620e59e05a3ae46a34b4d56f6.exe 2992 REGNETJO.EXE 3052 REGNETJO.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2992 2940 7767584620e59e05a3ae46a34b4d56f6.exe 28 PID 2940 wrote to memory of 2992 2940 7767584620e59e05a3ae46a34b4d56f6.exe 28 PID 2940 wrote to memory of 2992 2940 7767584620e59e05a3ae46a34b4d56f6.exe 28 PID 2940 wrote to memory of 2992 2940 7767584620e59e05a3ae46a34b4d56f6.exe 28 PID 2992 wrote to memory of 3052 2992 REGNETJO.EXE 29 PID 2992 wrote to memory of 3052 2992 REGNETJO.EXE 29 PID 2992 wrote to memory of 3052 2992 REGNETJO.EXE 29 PID 2992 wrote to memory of 3052 2992 REGNETJO.EXE 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7767584620e59e05a3ae46a34b4d56f6.exe"C:\Users\Admin\AppData\Local\Temp\7767584620e59e05a3ae46a34b4d56f6.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\WINDOWS\SysWOW64\REGNETJO.EXE"C:\WINDOWS\SYSTEM32\REGNETJO.EXE" C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\7767584620E59E05A3AE46A34B4D56F6.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\WINDOWS\SysWOW64\REGNETJO.EXE"C:\WINDOWS\SYSTEM32\REGNETJO.EXE" C:\WINDOWS\SYSWOW64\REGNETJO.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD57767584620e59e05a3ae46a34b4d56f6
SHA1cd7c8823a74fa3ad6e21b111599f2ac474e8f5c9
SHA256f6b64431b2de8c29d22aa58c2a98460f32c35e704f6598382a401e9cdd8c50bb
SHA51208964a1687cf9c7f7522d25d4423c056063654c5c4f76e95d7a09f58f57640d92defe638ec66936ca76c4c2788f57333915fbefd825e7a64a54e86eda3433c9d