Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
c9df0a6912fdd5a6dc0164127419a356.exe
Resource
win7-20240221-en
General
-
Target
c9df0a6912fdd5a6dc0164127419a356.exe
-
Size
51KB
-
MD5
c9df0a6912fdd5a6dc0164127419a356
-
SHA1
3ddd186b7ac1bc7235145dcabada0b7f5430ea1d
-
SHA256
9ed78c6d526cada01a9173984fb579b508ed75497a0fcf9c9bf1d7eea7cc128e
-
SHA512
642420b301d2e960abc948bcad85f616df2ac40799f3348141bd28db6bf70005ad22c0adb4e256e28d3f291cd43579f6b8c2cbf5d58ddabb7a49b6fcc17003f4
-
SSDEEP
768:81q4iZX3qdgbwEgKpUNrUrBW+RkceFKOu/E89jsUKbUQs0rZ1z2t5T1Bqu1KvGtY:84lZigbwEhl3RdUU1ajr+tB1f4Gtb+N
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c9df0a6912fdd5a6dc0164127419a356.exe -
Disables Task Manager via registry modification
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\XPPoliceAntivirus\setup.dat c9df0a6912fdd5a6dc0164127419a356.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\iehost.dll c9df0a6912fdd5a6dc0164127419a356.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\don't load c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\don't load\scui.cpl = "No" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\don't load\wscui.cpl = "No" c9df0a6912fdd5a6dc0164127419a356.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1912 2188 c9df0a6912fdd5a6dc0164127419a356.exe 28 PID 2188 wrote to memory of 1912 2188 c9df0a6912fdd5a6dc0164127419a356.exe 28 PID 2188 wrote to memory of 1912 2188 c9df0a6912fdd5a6dc0164127419a356.exe 28 PID 2188 wrote to memory of 1912 2188 c9df0a6912fdd5a6dc0164127419a356.exe 28 PID 2188 wrote to memory of 1912 2188 c9df0a6912fdd5a6dc0164127419a356.exe 28 PID 2188 wrote to memory of 1912 2188 c9df0a6912fdd5a6dc0164127419a356.exe 28 PID 2188 wrote to memory of 1912 2188 c9df0a6912fdd5a6dc0164127419a356.exe 28 PID 2188 wrote to memory of 2252 2188 c9df0a6912fdd5a6dc0164127419a356.exe 29 PID 2188 wrote to memory of 2252 2188 c9df0a6912fdd5a6dc0164127419a356.exe 29 PID 2188 wrote to memory of 2252 2188 c9df0a6912fdd5a6dc0164127419a356.exe 29 PID 2188 wrote to memory of 2252 2188 c9df0a6912fdd5a6dc0164127419a356.exe 29 PID 2252 wrote to memory of 2332 2252 net.exe 31 PID 2252 wrote to memory of 2332 2252 net.exe 31 PID 2252 wrote to memory of 2332 2252 net.exe 31 PID 2252 wrote to memory of 2332 2252 net.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe"C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe"1⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\iehost.dll2⤵PID:1912
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe stop "Security Center"2⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"3⤵PID:2332
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5c994684511f5bb0220adc6f5f533e7ab
SHA1504d19223b3fd86c282867f0283dd19b3cc2bda5
SHA2566858a1253169c034b83f3844dc4152ab8bee6a94840cf6366556baf11972ebfb
SHA5124ce2777f926392d83ec4512bfeca6e78b5a1667072ed4cea6edeb8439ee5da7963599994365ccd3350534c2d0efc8afcc049242776011f5f6811d8a8fa70e226