Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 23:11

General

  • Target

    c9df0a6912fdd5a6dc0164127419a356.exe

  • Size

    51KB

  • MD5

    c9df0a6912fdd5a6dc0164127419a356

  • SHA1

    3ddd186b7ac1bc7235145dcabada0b7f5430ea1d

  • SHA256

    9ed78c6d526cada01a9173984fb579b508ed75497a0fcf9c9bf1d7eea7cc128e

  • SHA512

    642420b301d2e960abc948bcad85f616df2ac40799f3348141bd28db6bf70005ad22c0adb4e256e28d3f291cd43579f6b8c2cbf5d58ddabb7a49b6fcc17003f4

  • SSDEEP

    768:81q4iZX3qdgbwEgKpUNrUrBW+RkceFKOu/E89jsUKbUQs0rZ1z2t5T1Bqu1KvGtY:84lZigbwEhl3RdUU1ajr+tB1f4Gtb+N

Malware Config

Signatures

  • Windows security bypass 2 TTPs 3 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Control Panel 3 IoCs
  • Modifies registry class 60 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe
    "C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe"
    1⤵
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Windows security modification
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\iehost.dll
      2⤵
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:1812
    • C:\Windows\SysWOW64\net.exe
      C:\Windows\system32\net.exe stop "Security Center"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3336
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "Security Center"
        3⤵
          PID:1856

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\iehost.dll

      Filesize

      19KB

      MD5

      c994684511f5bb0220adc6f5f533e7ab

      SHA1

      504d19223b3fd86c282867f0283dd19b3cc2bda5

      SHA256

      6858a1253169c034b83f3844dc4152ab8bee6a94840cf6366556baf11972ebfb

      SHA512

      4ce2777f926392d83ec4512bfeca6e78b5a1667072ed4cea6edeb8439ee5da7963599994365ccd3350534c2d0efc8afcc049242776011f5f6811d8a8fa70e226

    • memory/460-0-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/460-1-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/460-2-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/460-3-0x00000000005C0000-0x00000000005CC000-memory.dmp

      Filesize

      48KB

    • memory/460-4-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/460-12-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/1812-8-0x0000000010000000-0x0000000010008000-memory.dmp

      Filesize

      32KB

    • memory/1812-9-0x0000000000570000-0x0000000000576000-memory.dmp

      Filesize

      24KB

    • memory/1812-10-0x0000000010000000-0x0000000010008000-memory.dmp

      Filesize

      32KB

    • memory/1812-11-0x0000000000570000-0x0000000000576000-memory.dmp

      Filesize

      24KB