Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
mouse-delay.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mouse-delay.exe
Resource
win10v2004-20240426-en
General
-
Target
mouse-delay.exe
-
Size
97KB
-
MD5
356a901b9f81998e8c0baf63cabe85a5
-
SHA1
77e9df2f112722b39b027e2a3a2ac550ace2a41f
-
SHA256
4c53a396eec68c6f8a9b3a21171410b5f130905e2abab5bb447c530e5c14aaed
-
SHA512
1aecf70ea43210de82acbce78b9200b306fbcdd864b54f4c3581a06480bb7b8fa21d8d0c285607bb2955cbd9a662907d89cc2431a1447b05a9d136b7126118d4
-
SSDEEP
1536:b7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf2weHwgVFGyROf:37DhdC6kzWypvaQ0FxyNTBf2hwgVkyO
Malware Config
Signatures
-
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Input reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseHoverTime = "100" reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0" reg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC reg.exe Key created \REGISTRY\USER\.DEFAULT\Software reg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC\Enabled = "0" reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0" reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0" reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseTrails = "0" reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseHoverTime = "0" reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Mouse reg.exe Key created \REGISTRY\USER\.DEFAULT reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0" reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0" reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSensitivity = "10" reg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 1932 1236 mouse-delay.exe 86 PID 1236 wrote to memory of 1932 1236 mouse-delay.exe 86 PID 1932 wrote to memory of 1704 1932 cmd.exe 87 PID 1932 wrote to memory of 1704 1932 cmd.exe 87 PID 1932 wrote to memory of 2248 1932 cmd.exe 88 PID 1932 wrote to memory of 2248 1932 cmd.exe 88 PID 1932 wrote to memory of 3220 1932 cmd.exe 89 PID 1932 wrote to memory of 3220 1932 cmd.exe 89 PID 1932 wrote to memory of 2384 1932 cmd.exe 90 PID 1932 wrote to memory of 2384 1932 cmd.exe 90 PID 1932 wrote to memory of 4944 1932 cmd.exe 91 PID 1932 wrote to memory of 4944 1932 cmd.exe 91 PID 1932 wrote to memory of 3620 1932 cmd.exe 92 PID 1932 wrote to memory of 3620 1932 cmd.exe 92 PID 1932 wrote to memory of 1836 1932 cmd.exe 93 PID 1932 wrote to memory of 1836 1932 cmd.exe 93 PID 1932 wrote to memory of 3252 1932 cmd.exe 94 PID 1932 wrote to memory of 3252 1932 cmd.exe 94 PID 1932 wrote to memory of 3040 1932 cmd.exe 95 PID 1932 wrote to memory of 3040 1932 cmd.exe 95 PID 1932 wrote to memory of 4972 1932 cmd.exe 96 PID 1932 wrote to memory of 4972 1932 cmd.exe 96 PID 1932 wrote to memory of 3120 1932 cmd.exe 97 PID 1932 wrote to memory of 3120 1932 cmd.exe 97 PID 1932 wrote to memory of 2796 1932 cmd.exe 98 PID 1932 wrote to memory of 2796 1932 cmd.exe 98 PID 1932 wrote to memory of 4080 1932 cmd.exe 99 PID 1932 wrote to memory of 4080 1932 cmd.exe 99 PID 1932 wrote to memory of 4908 1932 cmd.exe 100 PID 1932 wrote to memory of 4908 1932 cmd.exe 100 PID 1932 wrote to memory of 3468 1932 cmd.exe 101 PID 1932 wrote to memory of 3468 1932 cmd.exe 101 PID 1932 wrote to memory of 428 1932 cmd.exe 102 PID 1932 wrote to memory of 428 1932 cmd.exe 102 PID 1932 wrote to memory of 2132 1932 cmd.exe 103 PID 1932 wrote to memory of 2132 1932 cmd.exe 103 PID 1932 wrote to memory of 2840 1932 cmd.exe 104 PID 1932 wrote to memory of 2840 1932 cmd.exe 104 PID 1932 wrote to memory of 3644 1932 cmd.exe 105 PID 1932 wrote to memory of 3644 1932 cmd.exe 105 PID 1932 wrote to memory of 4444 1932 cmd.exe 106 PID 1932 wrote to memory of 4444 1932 cmd.exe 106 PID 1932 wrote to memory of 2808 1932 cmd.exe 107 PID 1932 wrote to memory of 2808 1932 cmd.exe 107 PID 1932 wrote to memory of 940 1932 cmd.exe 108 PID 1932 wrote to memory of 940 1932 cmd.exe 108 PID 1932 wrote to memory of 4440 1932 cmd.exe 109 PID 1932 wrote to memory of 4440 1932 cmd.exe 109 PID 1932 wrote to memory of 4032 1932 cmd.exe 110 PID 1932 wrote to memory of 4032 1932 cmd.exe 110 PID 1932 wrote to memory of 4208 1932 cmd.exe 111 PID 1932 wrote to memory of 4208 1932 cmd.exe 111 PID 1932 wrote to memory of 4392 1932 cmd.exe 112 PID 1932 wrote to memory of 4392 1932 cmd.exe 112 PID 1932 wrote to memory of 4744 1932 cmd.exe 113 PID 1932 wrote to memory of 4744 1932 cmd.exe 113 PID 1932 wrote to memory of 4468 1932 cmd.exe 114 PID 1932 wrote to memory of 4468 1932 cmd.exe 114 PID 1932 wrote to memory of 1432 1932 cmd.exe 115 PID 1932 wrote to memory of 1432 1932 cmd.exe 115 PID 1932 wrote to memory of 5020 1932 cmd.exe 116 PID 1932 wrote to memory of 5020 1932 cmd.exe 116 PID 1932 wrote to memory of 4880 1932 cmd.exe 117 PID 1932 wrote to memory of 4880 1932 cmd.exe 117 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 3620 attrib.exe 1836 attrib.exe 3252 attrib.exe 2248 attrib.exe 3220 attrib.exe 2384 attrib.exe 4944 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mouse-delay.exe"C:\Users\Admin\AppData\Local\Temp\mouse-delay.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\72DE.tmp\72DF.tmp\72E0.bat C:\Users\Admin\AppData\Local\Temp\mouse-delay.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"3⤵PID:1704
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\72DE.tmp\72DF.tmp\72E0.bat"3⤵
- Views/modifies file attributes
PID:2248
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\wct31B4.tmp"3⤵
- Views/modifies file attributes
PID:3220
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\wct56F9.tmp"3⤵
- Views/modifies file attributes
PID:2384
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\wct7B69.tmp"3⤵
- Views/modifies file attributes
PID:4944
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\wctB601.tmp"3⤵
- Views/modifies file attributes
PID:3620
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\wctF1B3.tmp"3⤵
- Views/modifies file attributes
PID:1836
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\72DE.tmp\72DF.tmp\72E1.tmp"3⤵
- Views/modifies file attributes
PID:3252
-
-
C:\Windows\system32\chcp.comchcp 650013⤵PID:3040
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit" /v "LastKey" /t REG_SZ /d "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /f3⤵PID:4972
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "SmoothMouseYCurve" /t REG_BINARY /d "0000000000000000fd11010000000000002404000000000000fc12000000000000c0bb0100000000" /freg add "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v "MouseSpeed" /t reg_SZ /d "0" /f3⤵PID:3120
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:2796
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:4080
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f3⤵PID:4908
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "SmoothMouseYCurve" /t REG_BINARY /d "0000000000000000fd11010000000000002404000000000000fc12000000000000c0bb0100000000" /f3⤵PID:3468
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "100" /f3⤵
- Modifies data under HKEY_USERS
PID:428
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f3⤵
- Modifies data under HKEY_USERS
PID:2132
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:2840
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:3644
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:4444
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:2808
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseTrails" /t REG_SZ /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:940
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f3⤵PID:4440
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f3⤵PID:4032
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f3⤵PID:4208
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f3⤵PID:4392
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "0" /f3⤵PID:4744
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Mouse" /v "MouseTrails" /t REG_SZ /d "0" /f3⤵PID:4468
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass\Parameters" /v "MouseDataQueueSize" /t REG_DWORD /d "22" /f3⤵PID:1432
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "TreatAbsolutePointerAsAbsolute" /t REG_DWORD /d "1" /f3⤵PID:5020
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "TreatAbsoluteAsRelative" /t REG_DWORD /d "0" /f3⤵PID:4880
-
-
C:\Windows\system32\reg.exeReg.exe add "HKU\.DEFAULT\Software\Microsoft\Input\TIPC" /v "Enabled" /t REG_DWORD /d "0" /f3⤵
- Modifies data under HKEY_USERS
PID:2852
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorSpeed" /v "CursorSensitivity" /t REG_DWORD /d "10000" /f3⤵PID:2864
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorSpeed" /v "CursorUpdateInterval" /t REG_DWORD /d "1" /f3⤵PID:1840
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorSpeed" /v "IRRemoteNavigationDelta" /t REG_DWORD /d "1" /f3⤵PID:2800
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "AttractionRectInsetInDIPS" /t REG_DWORD /d "5" /f3⤵PID:4816
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "DistanceThresholdInDIPS" /t REG_DWORD /d "40" /f3⤵PID:1728
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "MagnetismDelayInMilliseconds" /t REG_DWORD /d "2" /f3⤵PID:400
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "MagnetismUpdateIntervalInMilliseconds" /t REG_DWORD /d "1" /f3⤵PID:2536
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "VelocityInDIPSPerSecond" /t REG_DWORD /d "360" /f3⤵PID:1056
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Cursors" /v "CursorDeadzoneJumpingSetting" /t REG_DWORD /d "0" /f3⤵PID:5076
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Cursors" /v "ContactVisualization" /t REG_DWORD /d "0" /f3⤵PID:4736
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Cursors" /v "GestureVisualization" /t REG_DWORD /d "0" /f3⤵PID:2376
-
-
C:\Windows\system32\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableCursorSuppression" /t REG_DWORD /d "0" /f3⤵PID:3864
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Pen" /v "DoubleTapTime" /t REG_DWORD /d "0" /f3⤵PID:884
-
-
C:\Windows\system32\reg.exeReg.exe add "HKCU\Control Panel\Pen" /v "DoubleClickHeight" /t REG_DWORD /d "64" /f3⤵PID:3188
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5cab8116562366799d3bf107f475c011d
SHA141a7fd1f222e7d0dcf1f27ca1a1569e7b7d3141c
SHA2563b0f38d15f0b8a6dff55d1888571d18be391d4d7ddd02e4b61fb6be4dc871d1c
SHA512004583119899a1f428789b837a2224a13137a44e795bdfbadda161aa13416ebb101dc80fcc1f04bed2a8fb17cb79edfbdc950d79d7e58c980fd76e52646f2e89