Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 00:29
Static task
static1
Behavioral task
behavioral1
Sample
5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe
Resource
win10v2004-20240508-en
General
-
Target
5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe
-
Size
74KB
-
MD5
6e60e0a26419e90b8876f02464a2e880
-
SHA1
34890edc24eb8abacbbcfc88eee6ebf5a84ae6a7
-
SHA256
5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa
-
SHA512
ebdfcd2783dd78fc57df73a44bdf289263d50fcf1dcd62d4049e5a679e3b4bc86d8b194d8f961805a2d77444ce514aadcc183398feff0209cbfde2c695cff0c9
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOrl1:GhfxHNIreQm+HiYl1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 808 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\notepad¢¬.exe 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe File opened for modification C:\Windows\SysWOW64\¢«.exe 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe File created C:\Windows\SysWOW64\¢«.exe 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe File created C:\Windows\system\rundll32.exe 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717201777" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717201777" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 808 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 808 rundll32.exe 808 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2364 wrote to memory of 808 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 85 PID 2364 wrote to memory of 808 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 85 PID 2364 wrote to memory of 808 2364 5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe"C:\Users\Admin\AppData\Local\Temp\5f0730782ac9f061f338fa75d380717838c131b99f249e1ee69c8b847f92d2fa.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD58b2a1f300833c4da604cf9fb02a92451
SHA18d8b2b8089711bb8533d42b0b1187c45aaea2a88
SHA2564a9465875085e8e457acc11eb47ee987793dc95de9c056a2a5fdc35bea9de599
SHA512b17bf1e4e65ee984c6d9df1aae3362136cb8b29351b7b3c672500f236ff186fcc7dea257ec7d2d6f5154461a263dc7d7d5dce70a530f495a16d6527f5740d490
-
Filesize
85KB
MD52c9537a827804a1d58d3e0c96753b70e
SHA1c4d3c46821c1cb7c66732a8a3d062915bcfb1565
SHA256231ec27d977ceeb9017fcfeab3796c9f9fe53915439ae7826ebc1c5a6a45052b
SHA512f53430f67132d0d6ea70520bd9e0157869c28bab54622212c808ffb4d00d37f6818ef82771f64ee2250e0d6496405a7041a6e8359d8b7bf3ab8143537be39dba