Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe
Resource
win10v2004-20240426-en
General
-
Target
cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe
-
Size
75KB
-
MD5
12460fe4258ab1ba4c2b77cb943eacd8
-
SHA1
0d40cc2d28bd0febf065d10e3a6646cbefb05c9c
-
SHA256
cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb
-
SHA512
603476131ce5422488ebf4d588219dd5a22efcd18d20b66bf676caf8a6d36fbbdbc0c47e42d57b345c65d56aafe50f0b999707b6784a4e5bf8aa2907a3de2c5c
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOvAI:GhfxHNIreQm+HiUAI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2456 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe File created C:\Windows\SysWOW64\¢«.exe cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe File created C:\Windows\SysWOW64\notepad¢¬.exe cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe File created C:\Windows\system\rundll32.exe cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717453782" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717453782" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2456 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 2456 rundll32.exe 2456 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2456 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 28 PID 1640 wrote to memory of 2456 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 28 PID 1640 wrote to memory of 2456 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 28 PID 1640 wrote to memory of 2456 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 28 PID 1640 wrote to memory of 2456 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 28 PID 1640 wrote to memory of 2456 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 28 PID 1640 wrote to memory of 2456 1640 cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe"C:\Users\Admin\AppData\Local\Temp\cf03ea4c076c8ed7a44667f26ee57b135bf65acb50f48f3b574f61b2eb1a49cb.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD595df74fea81a1875d23857a22ae315ef
SHA1f716e76af67d975f7e3b9ab36dfccf2088fbc8f0
SHA256d117ff6080e2ee4744338f87c50c544bab1070fd9a6ff12911a7de62fce59261
SHA5124209449a0d6f7f0890c8bd7cad2cc86ac3e0b712e81eb0175046d2c455140b567e58af971072baf03ce814ce36df8eeedb4c65485429e39a729cc48ec29659fa
-
Filesize
78KB
MD56d46910a5f393a0549de8022e0739c3a
SHA136a16cb60a512008c0637bd7c1f0bc7542bd254f
SHA25692e10836feb92a6bacd12263e1dc3c3c171a1152a8efdbd692b781d518c4cbda
SHA51262fc8aa7dddd8cdd50bd13350710c7858455e9e9cee881f094d2f0cb04dc7eefa76d11fd609b44056b66d42258e33a7300205cdfe6bbd9ee60c1b071c3569a9e