Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
e1254d7196cfeef80181eb075633e905.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1254d7196cfeef80181eb075633e905.exe
Resource
win10v2004-20240226-en
General
-
Target
e1254d7196cfeef80181eb075633e905.exe
-
Size
14KB
-
MD5
e1254d7196cfeef80181eb075633e905
-
SHA1
404c688e9fc99ea172c7d321954f0074b630bc98
-
SHA256
1612082491f40f3317035632aa95b9f46a21bf280adabf6d0d248e22c1d50de6
-
SHA512
4ee9e7ea212abf8842603914859f1361f7f638bfe7f3f309b7f518932bd553a0e26b76cdf38adcc87934bf8a13aa9eb90e55498c924099c770b56b16257e9005
-
SSDEEP
384:M/lNdn0Jp7lCqjYcMVerN3Zzj8vnqR+Vq+XUi:M/tIbjYcMQzjknqAqCUi
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\cliconfgzx.dll = "{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}" e1254d7196cfeef80181eb075633e905.exe -
Deletes itself 1 IoCs
pid Process 2536 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2144 e1254d7196cfeef80181eb075633e905.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\cliconfgzx.tmp e1254d7196cfeef80181eb075633e905.exe File opened for modification C:\Windows\SysWOW64\cliconfgzx.tmp e1254d7196cfeef80181eb075633e905.exe File opened for modification C:\Windows\SysWOW64\cliconfgzx.nls e1254d7196cfeef80181eb075633e905.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ThreadingModel = "Apartment" e1254d7196cfeef80181eb075633e905.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07} e1254d7196cfeef80181eb075633e905.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32 e1254d7196cfeef80181eb075633e905.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ = "C:\\Windows\\SysWow64\\cliconfgzx.dll" e1254d7196cfeef80181eb075633e905.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2144 e1254d7196cfeef80181eb075633e905.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2144 e1254d7196cfeef80181eb075633e905.exe 2144 e1254d7196cfeef80181eb075633e905.exe 2144 e1254d7196cfeef80181eb075633e905.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2536 2144 e1254d7196cfeef80181eb075633e905.exe 28 PID 2144 wrote to memory of 2536 2144 e1254d7196cfeef80181eb075633e905.exe 28 PID 2144 wrote to memory of 2536 2144 e1254d7196cfeef80181eb075633e905.exe 28 PID 2144 wrote to memory of 2536 2144 e1254d7196cfeef80181eb075633e905.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1254d7196cfeef80181eb075633e905.exe"C:\Users\Admin\AppData\Local\Temp\e1254d7196cfeef80181eb075633e905.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\C081.tmp.bat2⤵
- Deletes itself
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD570542992205d019844e2b683c2690bc3
SHA194796f9b12c71dc36fd8d5be425772e19ee9b940
SHA2567a15cd726570ee93cb75971d03cfd0b6c1b650d86660d5ffea7bc3b24eed630c
SHA51226e085277b8029775b164cf99c509192ecc7651a1a5ab29217380d46bf63b6c8964191dc82850efb53097fe09f1c8f71f83372be99b45d06bf947d75ad4b4458
-
Filesize
680KB
MD539c2e5b3e95fb77d36faa3acae21a4b1
SHA189340d06b3798e57a2c6f34ef12fb5b8f62fc408
SHA2563a78bd6bdedd6f416e8b29e29cd68638afe7f7b8d556e0288edc95b29c072d9e
SHA512355621fd0d4262c98f680d1d70f09b075acf6d28f21e516d2247d6939d328e2bf22f8b305f433ef508f7a778d6f5e7b6fdbf44ff2de793e9764393f375d0ebeb