Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
862d555f7f10302008d6fe78ab8b022e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
862d555f7f10302008d6fe78ab8b022e.exe
Resource
win10v2004-20231215-en
General
-
Target
862d555f7f10302008d6fe78ab8b022e.exe
-
Size
749KB
-
MD5
862d555f7f10302008d6fe78ab8b022e
-
SHA1
35b1f1b301053e9eb0e0addc530c1893898ea352
-
SHA256
681578d4fa37a378d08c805f74acaaab9c0f72c097888f5579554d3e4fdbf812
-
SHA512
fd8e5ae385b89ab79e036447f3d78f7ae6df41adb746d6b7d9cb8d0a82698d698573f3326de067a8b8042ad7bb39cf45c3b3abb8677fcbc969768c8541d63eef
-
SSDEEP
12288:ljXipx70Np/Z9xwy/bAHmdtYpkzz84cNZcu0uAimaLV+qvTOHsGiE:tX1/PWy/bAHmdWpCYNGu0emaZXqHsGi
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023231-15.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1104 862d555f7f10302008d6fe78ab8b022e.exe -
Loads dropped DLL 2 IoCs
pid Process 1104 862d555f7f10302008d6fe78ab8b022e.exe 1104 862d555f7f10302008d6fe78ab8b022e.exe -
resource yara_rule behavioral2/files/0x000a000000023231-15.dat upx behavioral2/memory/1104-18-0x0000000000830000-0x0000000000841000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srtserv = "C:\\ProgramData\\srtserv\\862d555f7f10302008d6fe78ab8b022e.exe" 862d555f7f10302008d6fe78ab8b022e.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2968 4644 WerFault.exe 15 4572 1104 WerFault.exe 88 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000008f57605912004170704461746100400009000400efbe8f5760594158a0332e00000093e101000000010000000000000000000000000000000f9450004100700070004400610074006100000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000008f57585b10004c6f63616c003c0009000400efbe8f5760594158a0332e000000a6e10100000001000000000000000000000000000000c7af04014c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000004158a033100054656d7000003a0009000400efbe8f5760594158a0332e000000a7e10100000001000000000000000000000000000000e1320e00540065006d007000000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000008f5760591100557365727300640009000400efbe874f77484158a0332e000000c70500000000010000000000000000003a0000000000bb7f5c0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000008f572a5f100041646d696e003c0009000400efbe8f5760594158a0332e00000088e101000000010000000000000000000000000000008c901b01410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 8a003100000000004158a03317003836324435357e310000720009000400efbe4158a0334158a0332e0000002632020000000c000000000000000000000000000000e1320e0038003600320064003500350035006600370066003100300033003000320030003000380064003600660065003700380061006200380062003000320032006500000018000000 explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1340 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1104 862d555f7f10302008d6fe78ab8b022e.exe 1104 862d555f7f10302008d6fe78ab8b022e.exe 1104 862d555f7f10302008d6fe78ab8b022e.exe 1104 862d555f7f10302008d6fe78ab8b022e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1340 explorer.exe 1340 explorer.exe 1104 862d555f7f10302008d6fe78ab8b022e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4644 wrote to memory of 408 4644 862d555f7f10302008d6fe78ab8b022e.exe 90 PID 4644 wrote to memory of 408 4644 862d555f7f10302008d6fe78ab8b022e.exe 90 PID 4644 wrote to memory of 408 4644 862d555f7f10302008d6fe78ab8b022e.exe 90 PID 4644 wrote to memory of 1104 4644 862d555f7f10302008d6fe78ab8b022e.exe 88 PID 4644 wrote to memory of 1104 4644 862d555f7f10302008d6fe78ab8b022e.exe 88 PID 4644 wrote to memory of 1104 4644 862d555f7f10302008d6fe78ab8b022e.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\862d555f7f10302008d6fe78ab8b022e.exe"C:\Users\Admin\AppData\Local\Temp\862d555f7f10302008d6fe78ab8b022e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 2202⤵
- Program crash
PID:2968
-
-
C:\ProgramData\srtserv\862d555f7f10302008d6fe78ab8b022e.exeC:\ProgramData\srtserv\862d555f7f10302008d6fe78ab8b022e.exe -wait2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 2203⤵
- Program crash
PID:4572
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\862d555f7f10302008d6fe78ab8b022e2⤵PID:408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4644 -ip 46441⤵PID:3024
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1340
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1104 -ip 11041⤵PID:116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5e0669670a3e3e517e8fc4eec21540bcb
SHA19186ff25866546c71f7f072faaeb69326a701e76
SHA25686d4934232276b3d213ac5e383c9bef75c424bcd1b2bfd6a16564786d6f98868
SHA512f25ef0f47f89967c9d82e4eed0396be7e27acf515882851aeb1ba7d56ca6311957d9b63d59f527f1770fe1ef012be63f440bfa912d046cc480884f2bed5c99b1
-
Filesize
70KB
MD52474523fa28d00c9bc0d3d8945fbe4c8
SHA148fa91de3591ecfa418cab859ad7d131840f2331
SHA2567b200395ba21ae23b2d9c682250fc7837c58aa1856c7c2ddde950fb26b06c749
SHA512b2510bf094fb424a3f0d551e8cf878b1bc47d61a43a39b459c0a6aa059461b0baf96406176a86d6b80bb165557070a0ee9cee2050b650a486f7d974439c2e2a8
-
Filesize
23KB
MD54a68bdeb219f697115c035d5f7000ee4
SHA19b3e7baaceb706b5d4f3c682806a7e27603b32f2
SHA256c505c9c35bc24243aabea8e349145c9dbff2da2ca6567fe2f750d887cc3cc27d
SHA512b9305d262d08171df9b7c8f937c328953ce84b621cdf37ffc74b27d84f1bf364460dc6d4da40dbb94317980699fca8b7b8a9a58a409db74baba81546b0253a34