Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 03:25
Behavioral task
behavioral1
Sample
48cefb137b69e2e659e2226a7bd5d9c0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
48cefb137b69e2e659e2226a7bd5d9c0N.exe
Resource
win10v2004-20240709-en
General
-
Target
48cefb137b69e2e659e2226a7bd5d9c0N.exe
-
Size
644KB
-
MD5
48cefb137b69e2e659e2226a7bd5d9c0
-
SHA1
a8b27f07c7b4a333fcaf75f937286cc764955509
-
SHA256
5cf6a4ba6364654169540fc204e7f68d53aa74b61c73577213de556815f045c4
-
SHA512
59f8c39a1b170aa7cde59d8f73c20f68022d35a0604c2d25279a9ab2eb500776c79de52ec85b9e3a7e44534e845cb9413668a6e00413808765062e4f1f1eb1b8
-
SSDEEP
12288:7tKe6Zv23YLVFhBsC8iFHSs7xPY1f6HriPwU8mNCZQUEsUB:v6Zv2ivhBVnFys7xP86LkRCkB
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msyjo32.exe" 48cefb137b69e2e659e2226a7bd5d9c0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983} spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msyjo32.exe" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983} 48cefb137b69e2e659e2226a7bd5d9c0N.exe -
Executes dropped EXE 1 IoCs
pid Process 352 spoolsv.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*" 48cefb137b69e2e659e2226a7bd5d9c0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*" spoolsv.exe -
resource yara_rule behavioral1/memory/1596-0-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/files/0x0008000000015fa3-5.dat upx behavioral1/files/0x0008000000015e46-12.dat upx behavioral1/memory/352-15-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/1596-14-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/352-16-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe" 48cefb137b69e2e659e2226a7bd5d9c0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe" 48cefb137b69e2e659e2226a7bd5d9c0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe" spoolsv.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msyjo32.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe File created C:\Windows\SysWOW64\concp32.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe File opened for modification C:\Windows\SysWOW64\concp32.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe File created C:\Windows\SysWOW64\vcl32.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe File opened for modification C:\Windows\SysWOW64\vcl32.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe File created C:\Windows\SysWOW64\msyjo32.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\spoolsv.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe File opened for modification C:\Windows\spoolsv.exe 48cefb137b69e2e659e2226a7bd5d9c0N.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\ax = d9ec11961b00dcf6f12ecbdb67d02fda 48cefb137b69e2e659e2226a7bd5d9c0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983} spoolsv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\u0 = 658663d26f8bad325217a06063847056939f558d910ed252e05dd0113550f7fc0f4da82ff73a0681ba604c2d4f23269f spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\v = "165" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983} 48cefb137b69e2e659e2226a7bd5d9c0N.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\sm = 01b8ec350471bd332433eee476ebe1f3 48cefb137b69e2e659e2226a7bd5d9c0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32 spoolsv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\u1 = 551d2e0658054ba756fd3798fea5ffca42865cb762a31639dabd7f2cca44e226 spoolsv.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\u2 = a54a6b702f92fdf2acd57599e2ae1608015dff41aa020117fc9bd8e2dcf4340f3fa61eb55d6f28597df90602703809d4 spoolsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{99F321B7-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32 48cefb137b69e2e659e2226a7bd5d9c0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*" 48cefb137b69e2e659e2226a7bd5d9c0N.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1596 48cefb137b69e2e659e2226a7bd5d9c0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1596 wrote to memory of 352 1596 48cefb137b69e2e659e2226a7bd5d9c0N.exe 30 PID 1596 wrote to memory of 352 1596 48cefb137b69e2e659e2226a7bd5d9c0N.exe 30 PID 1596 wrote to memory of 352 1596 48cefb137b69e2e659e2226a7bd5d9c0N.exe 30 PID 1596 wrote to memory of 352 1596 48cefb137b69e2e659e2226a7bd5d9c0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\48cefb137b69e2e659e2226a7bd5d9c0N.exe"C:\Users\Admin\AppData\Local\Temp\48cefb137b69e2e659e2226a7bd5d9c0N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\spoolsv.exeC:\Windows\spoolsv.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
PID:352
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD5842bbbf6e985b83b6516881aff10a828
SHA1f30d8f09a875fa247847c3a2a8763d773f310e0e
SHA25669930ac5a67a2b8ca0b0f46fd92ea19f9cb580cb343dcb7a50cec3dc2c63bd46
SHA5126896a9f9bc84f500abc7be6143ea2ff59b816f011df79c071729b1976cd0acc3f81c4976ffea219d4777c4f5cad6aafd4519f2df1867428406c4ef0662d566ae
-
Filesize
647KB
MD53c3b278950b89a43c37b87073c7fa879
SHA1b5e49f6144e25c393b5f0fe39292692a3c188e23
SHA2569fdc3602908a64c850826dc24d695b119921f620e55a1413d57b28bbe562f668
SHA5120a7ca97de4dffa24ec7e506d8bfcff0d3a6745359434ab8e45cb35ead347eeccdd5b3ea2d008a94ba355b0cadacfb1e2bcef9bb86b32fb6ba466835533f50506