Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 23:17
Static task
static1
Behavioral task
behavioral1
Sample
684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe
Resource
win10v2004-20240508-en
General
-
Target
684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe
-
Size
77KB
-
MD5
01119b49e0df05813cb902d617987c8d
-
SHA1
61f6895a0bd6301840d8e7d27e1e93950967b6ab
-
SHA256
684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da
-
SHA512
40ddf5d87cdaf01b3f40fac0515d2a57ce88f1f29982e32e3c5b36bda3f68b0c9e80424bc2515c2d35ff90e1c46e43702a4de99b14204fd318e4ac2fc1899dcc
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOXyC:GhfxHNIreQm+HiQyC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2036 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe File created C:\Windows\SysWOW64\¢«.exe 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe File created C:\Windows\system\rundll32.exe 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1716160678" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1716160678" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 2036 rundll32.exe 2036 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2036 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 28 PID 1952 wrote to memory of 2036 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 28 PID 1952 wrote to memory of 2036 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 28 PID 1952 wrote to memory of 2036 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 28 PID 1952 wrote to memory of 2036 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 28 PID 1952 wrote to memory of 2036 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 28 PID 1952 wrote to memory of 2036 1952 684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe"C:\Users\Admin\AppData\Local\Temp\684f6d1c1e97c7982baf8b050fc4754f83e3b436d339cfc581e85f7a9cba95da.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD517156bb892e59bec753e102a63332d48
SHA1ffb555d46bb590df4a77a46fb3c5a5f51ceb5a7e
SHA2564a9400ce11f58ab22efded5202da4ec6215a82a73bdf4d4aaf7114669dc5d682
SHA51207b4c7044fd6bc1e53d1424c1b7ebedb448855f9c39f7f09b8aca9bcf53c0b74fbd88e304c6c0e9b8411af0cbf60fdb126bf61a4c8f22c61c56683822dc49034
-
Filesize
80KB
MD55ffb7ed93a94336288743226cdf59df4
SHA11f354bac3649f5ab0ea7e82888113a6d2c873a29
SHA2568f21c2043b0e5ada5833054c5218c98f78c7c9e650a0534ab5c7d5e583cd30f2
SHA51245b1594000ccf8ee5fb3c3ae3de54edb65e7e5482543281160b2954e62c63199bc3ddfbf97b0886c268d83b1ac3576421620a6a2cb1d06b4257b79fd8a69e977