Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    15s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2024, 22:42

General

  • Target

    mouse-delay.exe

  • Size

    97KB

  • MD5

    356a901b9f81998e8c0baf63cabe85a5

  • SHA1

    77e9df2f112722b39b027e2a3a2ac550ace2a41f

  • SHA256

    4c53a396eec68c6f8a9b3a21171410b5f130905e2abab5bb447c530e5c14aaed

  • SHA512

    1aecf70ea43210de82acbce78b9200b306fbcdd864b54f4c3581a06480bb7b8fa21d8d0c285607bb2955cbd9a662907d89cc2431a1447b05a9d136b7126118d4

  • SSDEEP

    1536:b7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf2weHwgVFGyROf:37DhdC6kzWypvaQ0FxyNTBf2hwgVkyO

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mouse-delay.exe
    "C:\Users\Admin\AppData\Local\Temp\mouse-delay.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\72DE.tmp\72DF.tmp\72E0.bat C:\Users\Admin\AppData\Local\Temp\mouse-delay.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Windows\system32\cacls.exe
        "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
        3⤵
          PID:1704
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\72DE.tmp\72DF.tmp\72E0.bat"
          3⤵
          • Views/modifies file attributes
          PID:2248
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wct31B4.tmp"
          3⤵
          • Views/modifies file attributes
          PID:3220
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wct56F9.tmp"
          3⤵
          • Views/modifies file attributes
          PID:2384
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wct7B69.tmp"
          3⤵
          • Views/modifies file attributes
          PID:4944
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wctB601.tmp"
          3⤵
          • Views/modifies file attributes
          PID:3620
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\wctF1B3.tmp"
          3⤵
          • Views/modifies file attributes
          PID:1836
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\72DE.tmp\72DF.tmp\72E1.tmp"
          3⤵
          • Views/modifies file attributes
          PID:3252
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:3040
          • C:\Windows\system32\reg.exe
            Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit" /v "LastKey" /t REG_SZ /d "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /f
            3⤵
              PID:4972
            • C:\Windows\system32\reg.exe
              Reg.exe add "HKCU\Control Panel\Mouse" /v "SmoothMouseYCurve" /t REG_BINARY /d "0000000000000000fd11010000000000002404000000000000fc12000000000000c0bb0100000000" /freg add "HKEY_USERS\.DEFAULT\Control Panel\Mouse" /v "MouseSpeed" /t reg_SZ /d "0" /f
              3⤵
                PID:3120
              • C:\Windows\system32\reg.exe
                Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f
                3⤵
                • Modifies data under HKEY_USERS
                PID:2796
              • C:\Windows\system32\reg.exe
                Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f
                3⤵
                • Modifies data under HKEY_USERS
                PID:4080
              • C:\Windows\system32\reg.exe
                Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f
                3⤵
                  PID:4908
                • C:\Windows\system32\reg.exe
                  Reg.exe add "HKCU\Control Panel\Mouse" /v "SmoothMouseYCurve" /t REG_BINARY /d "0000000000000000fd11010000000000002404000000000000fc12000000000000c0bb0100000000" /f
                  3⤵
                    PID:3468
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "100" /f
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:428
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:2132
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:2840
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:3644
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:4444
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "0" /f
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:2808
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKU\.DEFAULT\Control Panel\Mouse" /v "MouseTrails" /t REG_SZ /d "0" /f
                    3⤵
                    • Modifies data under HKEY_USERS
                    PID:940
                  • C:\Windows\system32\reg.exe
                    Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseSensitivity" /t REG_SZ /d "10" /f
                    3⤵
                      PID:4440
                    • C:\Windows\system32\reg.exe
                      Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f
                      3⤵
                        PID:4032
                      • C:\Windows\system32\reg.exe
                        Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f
                        3⤵
                          PID:4208
                        • C:\Windows\system32\reg.exe
                          Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f
                          3⤵
                            PID:4392
                          • C:\Windows\system32\reg.exe
                            Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "0" /f
                            3⤵
                              PID:4744
                            • C:\Windows\system32\reg.exe
                              Reg.exe add "HKCU\Control Panel\Mouse" /v "MouseTrails" /t REG_SZ /d "0" /f
                              3⤵
                                PID:4468
                              • C:\Windows\system32\reg.exe
                                Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass\Parameters" /v "MouseDataQueueSize" /t REG_DWORD /d "22" /f
                                3⤵
                                  PID:1432
                                • C:\Windows\system32\reg.exe
                                  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "TreatAbsolutePointerAsAbsolute" /t REG_DWORD /d "1" /f
                                  3⤵
                                    PID:5020
                                  • C:\Windows\system32\reg.exe
                                    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "TreatAbsoluteAsRelative" /t REG_DWORD /d "0" /f
                                    3⤵
                                      PID:4880
                                    • C:\Windows\system32\reg.exe
                                      Reg.exe add "HKU\.DEFAULT\Software\Microsoft\Input\TIPC" /v "Enabled" /t REG_DWORD /d "0" /f
                                      3⤵
                                      • Modifies data under HKEY_USERS
                                      PID:2852
                                    • C:\Windows\system32\reg.exe
                                      Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorSpeed" /v "CursorSensitivity" /t REG_DWORD /d "10000" /f
                                      3⤵
                                        PID:2864
                                      • C:\Windows\system32\reg.exe
                                        Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorSpeed" /v "CursorUpdateInterval" /t REG_DWORD /d "1" /f
                                        3⤵
                                          PID:1840
                                        • C:\Windows\system32\reg.exe
                                          Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorSpeed" /v "IRRemoteNavigationDelta" /t REG_DWORD /d "1" /f
                                          3⤵
                                            PID:2800
                                          • C:\Windows\system32\reg.exe
                                            Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "AttractionRectInsetInDIPS" /t REG_DWORD /d "5" /f
                                            3⤵
                                              PID:4816
                                            • C:\Windows\system32\reg.exe
                                              Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "DistanceThresholdInDIPS" /t REG_DWORD /d "40" /f
                                              3⤵
                                                PID:1728
                                              • C:\Windows\system32\reg.exe
                                                Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "MagnetismDelayInMilliseconds" /t REG_DWORD /d "2" /f
                                                3⤵
                                                  PID:400
                                                • C:\Windows\system32\reg.exe
                                                  Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "MagnetismUpdateIntervalInMilliseconds" /t REG_DWORD /d "1" /f
                                                  3⤵
                                                    PID:2536
                                                  • C:\Windows\system32\reg.exe
                                                    Reg.exe add "HKLM\SOFTWARE\Microsoft\Input\Settings\ControllerProcessor\CursorMagnetism" /v "VelocityInDIPSPerSecond" /t REG_DWORD /d "360" /f
                                                    3⤵
                                                      PID:1056
                                                    • C:\Windows\system32\reg.exe
                                                      Reg.exe add "HKCU\Control Panel\Cursors" /v "CursorDeadzoneJumpingSetting" /t REG_DWORD /d "0" /f
                                                      3⤵
                                                        PID:5076
                                                      • C:\Windows\system32\reg.exe
                                                        Reg.exe add "HKCU\Control Panel\Cursors" /v "ContactVisualization" /t REG_DWORD /d "0" /f
                                                        3⤵
                                                          PID:4736
                                                        • C:\Windows\system32\reg.exe
                                                          Reg.exe add "HKCU\Control Panel\Cursors" /v "GestureVisualization" /t REG_DWORD /d "0" /f
                                                          3⤵
                                                            PID:2376
                                                          • C:\Windows\system32\reg.exe
                                                            Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableCursorSuppression" /t REG_DWORD /d "0" /f
                                                            3⤵
                                                              PID:3864
                                                            • C:\Windows\system32\reg.exe
                                                              Reg.exe add "HKCU\Control Panel\Pen" /v "DoubleTapTime" /t REG_DWORD /d "0" /f
                                                              3⤵
                                                                PID:884
                                                              • C:\Windows\system32\reg.exe
                                                                Reg.exe add "HKCU\Control Panel\Pen" /v "DoubleClickHeight" /t REG_DWORD /d "64" /f
                                                                3⤵
                                                                  PID:3188

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Temp\72DE.tmp\72DF.tmp\72E0.bat

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              cab8116562366799d3bf107f475c011d

                                                              SHA1

                                                              41a7fd1f222e7d0dcf1f27ca1a1569e7b7d3141c

                                                              SHA256

                                                              3b0f38d15f0b8a6dff55d1888571d18be391d4d7ddd02e4b61fb6be4dc871d1c

                                                              SHA512

                                                              004583119899a1f428789b837a2224a13137a44e795bdfbadda161aa13416ebb101dc80fcc1f04bed2a8fb17cb79edfbdc950d79d7e58c980fd76e52646f2e89