Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
4c3efbaf08e29e7a9e557d11c69eb9d0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4c3efbaf08e29e7a9e557d11c69eb9d0N.exe
Resource
win10v2004-20240709-en
General
-
Target
4c3efbaf08e29e7a9e557d11c69eb9d0N.exe
-
Size
31KB
-
MD5
4c3efbaf08e29e7a9e557d11c69eb9d0
-
SHA1
c653d804ca130ce626821005c552a8e16827687e
-
SHA256
89cf672b4d9758ac461960c7b50cc7dd1748eb41a80c9486a64caccc6cdb23fa
-
SHA512
decddac20c0ae05dc5b8d9b19adb2ecd43aac3b804556439ee88daae119211b8f9376a054fd5f072be8e39e7d3a9711aceb23abcf84b9812299e4285d689016c
-
SSDEEP
768:PVEHJqjHyGvwFylDpulVSQJrE/2QmlCYZUl8zJHzjHCG:PH2nylslwHCCLc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2448 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe File opened for modification C:\Windows\SysWOW64\¢«.exe 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe File created C:\Windows\SysWOW64\¢«.exe 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe File created C:\Windows\system\rundll32.exe 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1721361009" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1721361009" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2448 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 2448 rundll32.exe 2448 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2448 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 30 PID 3060 wrote to memory of 2448 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 30 PID 3060 wrote to memory of 2448 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 30 PID 3060 wrote to memory of 2448 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 30 PID 3060 wrote to memory of 2448 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 30 PID 3060 wrote to memory of 2448 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 30 PID 3060 wrote to memory of 2448 3060 4c3efbaf08e29e7a9e557d11c69eb9d0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c3efbaf08e29e7a9e557d11c69eb9d0N.exe"C:\Users\Admin\AppData\Local\Temp\4c3efbaf08e29e7a9e557d11c69eb9d0N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD52413ee08ae8370e666690ecec48ee8dc
SHA195682fc85d8a2df8d005132446e35aa771e24d75
SHA2564f019fe276761b4cf8fe950be19b5335eb24a9e36349fcf00146fd63a9a9c1ba
SHA51240577bf2618a5c2e65610f5aaa876d559fea1052caff6ba8bba6febadfa84218b1fd7aa57c45c367e2905021ce0ae2776841d9de7299115912a96ce790a0723d