Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe
Resource
win10v2004-20240508-en
General
-
Target
accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe
-
Size
79KB
-
MD5
1c735fc28f2cfcca56d4767c443493d9
-
SHA1
0fe1407d0e0937b8fc4154c6ec87e76e92c86c81
-
SHA256
accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80
-
SHA512
4d3c7b6d8015afa9a59607281bfb58b65a48db61a29ded74e6330fa8ac3db0dc42e1826d31275f79c7d348019fdd56376fc3803a707076de52c2619a3e450962
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOptkz:GhfxHNIreQm+Hi2tkz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2548 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe File created C:\Windows\SysWOW64\¢«.exe accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe File created C:\Windows\SysWOW64\notepad¢¬.exe accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe File created C:\Windows\system\rundll32.exe accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717396361" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717396361" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2548 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 2548 rundll32.exe 2548 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2548 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 28 PID 2976 wrote to memory of 2548 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 28 PID 2976 wrote to memory of 2548 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 28 PID 2976 wrote to memory of 2548 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 28 PID 2976 wrote to memory of 2548 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 28 PID 2976 wrote to memory of 2548 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 28 PID 2976 wrote to memory of 2548 2976 accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe"C:\Users\Admin\AppData\Local\Temp\accb294d4398085d1913df4b8f0641e425a3d1816ae16c21cb9fc636c488fe80.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD51d14062d10987aec2d93c5794dd0e82a
SHA12c26e767cbba7dad65198db344047b78eff88453
SHA256c4345e82219b919acb0b735cc971cbaaed27dc05da5d8739fd35d865f6d74078
SHA5125866562d01550f7cb830038fc1663e50f8234ffd3e6bcea67a5264e9c47782a5e3af0f87da0557b3b81a001fb18c3d768d04fa5e72fe3cb5853427661ce566e4
-
Filesize
83KB
MD55e3cc87fd60c1710c1a10f1c6108a57c
SHA1f5fe5b6efdd17257cd9d6ed97d8f1faee0050ba5
SHA256e5dea0b18db688d08915317611180a0bab8efaf3cf6ef5f55ecdb0eb22b76aff
SHA5126c85c98c13c00a665f6933b0c5a9bf434d5c37bcc7ec92b28681d7fcd1893a3747b4b529eeed9eb33f18d6dd6c3a273a223ab3c2a6e58d6a5889cece32942942