Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 03:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba602c3029f8e389156c8de6fac9f7da.exe
Resource
win7-20231129-en
8 signatures
150 seconds
General
-
Target
ba602c3029f8e389156c8de6fac9f7da.exe
-
Size
96KB
-
MD5
ba602c3029f8e389156c8de6fac9f7da
-
SHA1
b4551ff6ec081269d16f4287e478fc714441de33
-
SHA256
8cad060f5372056e8891e0ef9eec771359c996a9553f1e87f868264fc67a2df9
-
SHA512
70704b40de90ccd01120e505fc1216d7e67aca98db35bc943572f0693a29d3a72ad15cfbf3cf1ef1884c8a1cc53efc50649de22f3850c864fa3e6120adf58bec
-
SSDEEP
1536:6TqaxQsuaZ+McIiqChuygKS3bir8P5QmlKRhbvDWBQZ2/36bouMppmUkZmyM:cxzuaZ+hmyfTkKzfWqkuzny
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ba602c3029f8e389156c8de6fac9f7da.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\Internet Explorer\IEXPLORE.EXE = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer" ba602c3029f8e389156c8de6fac9f7da.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\browser helper objects\{36DBC179-A19F-48F2-B16A-6A3E19B42A87} ba602c3029f8e389156c8de6fac9f7da.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ipv6monl.dll ba602c3029f8e389156c8de6fac9f7da.exe File created C:\Windows\SysWOW64\ipv6monl.dll ba602c3029f8e389156c8de6fac9f7da.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1108 set thread context of 2188 1108 ba602c3029f8e389156c8de6fac9f7da.exe 28 -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" ba602c3029f8e389156c8de6fac9f7da.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32\ = "C:\\Windows\\SysWow64\\ipv6monl.dll" ba602c3029f8e389156c8de6fac9f7da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32\ThreadingModel = "apartment" ba602c3029f8e389156c8de6fac9f7da.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87} ba602c3029f8e389156c8de6fac9f7da.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87} ba602c3029f8e389156c8de6fac9f7da.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{36DBC179-A19F-48F2-B16A-6A3E19B42A87}\InprocServer32 ba602c3029f8e389156c8de6fac9f7da.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2188 ba602c3029f8e389156c8de6fac9f7da.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2188 1108 ba602c3029f8e389156c8de6fac9f7da.exe 28 PID 1108 wrote to memory of 2188 1108 ba602c3029f8e389156c8de6fac9f7da.exe 28 PID 1108 wrote to memory of 2188 1108 ba602c3029f8e389156c8de6fac9f7da.exe 28 PID 1108 wrote to memory of 2188 1108 ba602c3029f8e389156c8de6fac9f7da.exe 28 PID 1108 wrote to memory of 2188 1108 ba602c3029f8e389156c8de6fac9f7da.exe 28 PID 1108 wrote to memory of 2188 1108 ba602c3029f8e389156c8de6fac9f7da.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba602c3029f8e389156c8de6fac9f7da.exe"C:\Users\Admin\AppData\Local\Temp\ba602c3029f8e389156c8de6fac9f7da.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\ba602c3029f8e389156c8de6fac9f7da.exeC:\Users\Admin\AppData\Local\Temp\ba602c3029f8e389156c8de6fac9f7da.exe2⤵
- Modifies firewall policy service
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2188
-