Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
e1254d7196cfeef80181eb075633e905.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1254d7196cfeef80181eb075633e905.exe
Resource
win10v2004-20240226-en
General
-
Target
e1254d7196cfeef80181eb075633e905.exe
-
Size
14KB
-
MD5
e1254d7196cfeef80181eb075633e905
-
SHA1
404c688e9fc99ea172c7d321954f0074b630bc98
-
SHA256
1612082491f40f3317035632aa95b9f46a21bf280adabf6d0d248e22c1d50de6
-
SHA512
4ee9e7ea212abf8842603914859f1361f7f638bfe7f3f309b7f518932bd553a0e26b76cdf38adcc87934bf8a13aa9eb90e55498c924099c770b56b16257e9005
-
SSDEEP
384:M/lNdn0Jp7lCqjYcMVerN3Zzj8vnqR+Vq+XUi:M/tIbjYcMQzjknqAqCUi
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\cliconfgzx.dll = "{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}" e1254d7196cfeef80181eb075633e905.exe -
Loads dropped DLL 1 IoCs
pid Process 3592 e1254d7196cfeef80181eb075633e905.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cliconfgzx.tmp e1254d7196cfeef80181eb075633e905.exe File opened for modification C:\Windows\SysWOW64\cliconfgzx.nls e1254d7196cfeef80181eb075633e905.exe File created C:\Windows\SysWOW64\cliconfgzx.tmp e1254d7196cfeef80181eb075633e905.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32 e1254d7196cfeef80181eb075633e905.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ = "C:\\Windows\\SysWow64\\cliconfgzx.dll" e1254d7196cfeef80181eb075633e905.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ThreadingModel = "Apartment" e1254d7196cfeef80181eb075633e905.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07} e1254d7196cfeef80181eb075633e905.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3592 e1254d7196cfeef80181eb075633e905.exe 3592 e1254d7196cfeef80181eb075633e905.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3592 e1254d7196cfeef80181eb075633e905.exe 3592 e1254d7196cfeef80181eb075633e905.exe 3592 e1254d7196cfeef80181eb075633e905.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3592 wrote to memory of 2444 3592 e1254d7196cfeef80181eb075633e905.exe 100 PID 3592 wrote to memory of 2444 3592 e1254d7196cfeef80181eb075633e905.exe 100 PID 3592 wrote to memory of 2444 3592 e1254d7196cfeef80181eb075633e905.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1254d7196cfeef80181eb075633e905.exe"C:\Users\Admin\AppData\Local\Temp\e1254d7196cfeef80181eb075633e905.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\B97C.tmp.bat2⤵PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD570542992205d019844e2b683c2690bc3
SHA194796f9b12c71dc36fd8d5be425772e19ee9b940
SHA2567a15cd726570ee93cb75971d03cfd0b6c1b650d86660d5ffea7bc3b24eed630c
SHA51226e085277b8029775b164cf99c509192ecc7651a1a5ab29217380d46bf63b6c8964191dc82850efb53097fe09f1c8f71f83372be99b45d06bf947d75ad4b4458
-
Filesize
543KB
MD5767a7aec5f3b54e5960cf391bba04d93
SHA106e0efbfd7be23667c38ebb473b68e70289f58c5
SHA2566c085eb75ba4f6b4d8441f42b6ff53fc386fd798e3d142341c00b85fb16e74b9
SHA5121ddd6fcd93472e6fb05f9d2e58c8acfdaf5d16b8df04a9420bdda039b8dfcb0fae6ead52a4ef61aba46b9b2a55125a0b1ef429cdbe75cd6a9d0269a4d21fadd0