Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
c9df0a6912fdd5a6dc0164127419a356.exe
Resource
win7-20240221-en
General
-
Target
c9df0a6912fdd5a6dc0164127419a356.exe
-
Size
51KB
-
MD5
c9df0a6912fdd5a6dc0164127419a356
-
SHA1
3ddd186b7ac1bc7235145dcabada0b7f5430ea1d
-
SHA256
9ed78c6d526cada01a9173984fb579b508ed75497a0fcf9c9bf1d7eea7cc128e
-
SHA512
642420b301d2e960abc948bcad85f616df2ac40799f3348141bd28db6bf70005ad22c0adb4e256e28d3f291cd43579f6b8c2cbf5d58ddabb7a49b6fcc17003f4
-
SSDEEP
768:81q4iZX3qdgbwEgKpUNrUrBW+RkceFKOu/E89jsUKbUQs0rZ1z2t5T1Bqu1KvGtY:84lZigbwEhl3RdUU1ajr+tB1f4Gtb+N
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c9df0a6912fdd5a6dc0164127419a356.exe -
Disables Task Manager via registry modification
-
Loads dropped DLL 1 IoCs
pid Process 1812 regsvr32.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c9df0a6912fdd5a6dc0164127419a356.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b6b571fb-b71d-449c-ad70-82e966328795} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b6b571fb-b71d-449c-ad70-82e966328795}\NoExplorer = "1" regsvr32.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\XPPoliceAntivirus\setup.dat c9df0a6912fdd5a6dc0164127419a356.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\iehost.dll c9df0a6912fdd5a6dc0164127419a356.exe -
Modifies Control Panel 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\don't load\wscui.cpl = "No" c9df0a6912fdd5a6dc0164127419a356.exe Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\don't load c9df0a6912fdd5a6dc0164127419a356.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\don't load\scui.cpl = "No" c9df0a6912fdd5a6dc0164127419a356.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe\ = "WinSafe Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\VersionIndependentProgID\ = "WinApp.WinSafe" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\InprocServer32\ = "C:\\Windows\\iehost.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe.1\ = "WinSafe Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\ProgID\ = "WinApp.WinSafe.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\ = "WinSafe 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\0\win32\ = "C:\\Windows\\iehost.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe\CurVer\ = "WinApp.WinSafe.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{16406580-14CE-4441-B904-AD56CC8064CA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe.1\CLSID\ = "{b6b571fb-b71d-449c-ad70-82e966328795}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\ = "WinSafe Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\ = "{16406580-14CE-4441-B904-AD56CC8064CA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\ = "IBhoApp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{16406580-14CE-4441-B904-AD56CC8064CA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe\CLSID\ = "{b6b571fb-b71d-449c-ad70-82e966328795}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\TypeLib\ = "{16406580-14ce-4441-b904-ad56cc8064ca}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ = "_IBhoAppEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\ = "{16406580-14CE-4441-B904-AD56CC8064CA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0\HELPDIR\ = "C:\\Windows" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WinApp.WinSafe.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b6b571fb-b71d-449c-ad70-82e966328795}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{16406580-14CE-4441-B904-AD56CC8064CA}\1.0 regsvr32.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 460 wrote to memory of 1812 460 c9df0a6912fdd5a6dc0164127419a356.exe 91 PID 460 wrote to memory of 1812 460 c9df0a6912fdd5a6dc0164127419a356.exe 91 PID 460 wrote to memory of 1812 460 c9df0a6912fdd5a6dc0164127419a356.exe 91 PID 460 wrote to memory of 3336 460 c9df0a6912fdd5a6dc0164127419a356.exe 93 PID 460 wrote to memory of 3336 460 c9df0a6912fdd5a6dc0164127419a356.exe 93 PID 460 wrote to memory of 3336 460 c9df0a6912fdd5a6dc0164127419a356.exe 93 PID 3336 wrote to memory of 1856 3336 net.exe 95 PID 3336 wrote to memory of 1856 3336 net.exe 95 PID 3336 wrote to memory of 1856 3336 net.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe"C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe"1⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\iehost.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1812
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe stop "Security Center"2⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"3⤵PID:1856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5c994684511f5bb0220adc6f5f533e7ab
SHA1504d19223b3fd86c282867f0283dd19b3cc2bda5
SHA2566858a1253169c034b83f3844dc4152ab8bee6a94840cf6366556baf11972ebfb
SHA5124ce2777f926392d83ec4512bfeca6e78b5a1667072ed4cea6edeb8439ee5da7963599994365ccd3350534c2d0efc8afcc049242776011f5f6811d8a8fa70e226