Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
d435ca3a32cf0a322e03ef4eee5424e9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d435ca3a32cf0a322e03ef4eee5424e9.exe
Resource
win10v2004-20240226-en
General
-
Target
d435ca3a32cf0a322e03ef4eee5424e9.exe
-
Size
16KB
-
MD5
d435ca3a32cf0a322e03ef4eee5424e9
-
SHA1
29a3d304aa32705bdec80bb5374a3449774a76d1
-
SHA256
f8e8d9079cb6bc2c1adc7a7e00af3ce27f46b5394b38666f4623cc095da62224
-
SHA512
2125769f35aaa1403b34b1947960d895e388ac080c0ab9b34c9821d2b857ab0984c0c944d561fd892597a25456cc8dcbb489d6913dff0279eb1b8534dbbccb8f
-
SSDEEP
384:RnlGe8iIwTUkgWp66dFFgl6eGG1lg6cdjn1NLd:RnlnFq6eP1lI11NL
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" d435ca3a32cf0a322e03ef4eee5424e9.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\spools.exe d435ca3a32cf0a322e03ef4eee5424e9.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe d435ca3a32cf0a322e03ef4eee5424e9.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" d435ca3a32cf0a322e03ef4eee5424e9.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\cftmon.exe \"%1\" %*" d435ca3a32cf0a322e03ef4eee5424e9.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" d435ca3a32cf0a322e03ef4eee5424e9.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\cftmon.exe" d435ca3a32cf0a322e03ef4eee5424e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" d435ca3a32cf0a322e03ef4eee5424e9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\cftmon.exe" d435ca3a32cf0a322e03ef4eee5424e9.exe Key deleted \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" d435ca3a32cf0a322e03ef4eee5424e9.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\cftmon.exe \"%1\" %*" d435ca3a32cf0a322e03ef4eee5424e9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 752 wrote to memory of 456 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 88 PID 752 wrote to memory of 456 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 88 PID 752 wrote to memory of 456 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 88 PID 752 wrote to memory of 1840 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 89 PID 752 wrote to memory of 1840 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 89 PID 752 wrote to memory of 1840 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 89 PID 752 wrote to memory of 552 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 90 PID 752 wrote to memory of 552 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 90 PID 752 wrote to memory of 552 752 d435ca3a32cf0a322e03ef4eee5424e9.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\d435ca3a32cf0a322e03ef4eee5424e9.exe"C:\Users\Admin\AppData\Local\Temp\d435ca3a32cf0a322e03ef4eee5424e9.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies WinLogon
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
PID:456
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f2⤵
- Adds Run key to start application
PID:1840
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f2⤵
- Adds Run key to start application
PID:552
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Event Triggered Execution
1Change Default File Association
1