Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
submitted
22/08/2024, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe
Resource
win10v2004-20240802-en
General
-
Target
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe
-
Size
80KB
-
MD5
a5cd8fc525b13f71b9051df0df4c81bc
-
SHA1
b03143816c1bce1584a7b010049ccaf1bb61b539
-
SHA256
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0
-
SHA512
4d565650babf1c64299fa8d917e1c0e4cdd15820fde47891f5a8e027f260b6e731fbad0d3636e5bb239a0df2b6669b453c044857b9967311e47b7c2efefb038b
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOTpas:GhfxHNIreQm+Hispas
Malware Config
Extracted
qqpass
http://www.zigui.org/article.php?id=103822
-
url
http://www.mxm9191.com/myrunner_up.exe
-
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Signatures
-
Qqpass family
-
Executes dropped EXE 1 IoCs
pid Process 2440 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\¢«.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File opened for modification C:\Windows\SysWOW64\¢«.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File created C:\Windows\system\rundll32.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1724316021" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1724316021" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2440 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 2440 rundll32.exe 2440 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2440 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 29 PID 2388 wrote to memory of 2440 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 29 PID 2388 wrote to memory of 2440 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 29 PID 2388 wrote to memory of 2440 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 29 PID 2388 wrote to memory of 2440 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 29 PID 2388 wrote to memory of 2440 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 29 PID 2388 wrote to memory of 2440 2388 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe"C:\Users\Admin\AppData\Local\Temp\1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5532fa0adac84ff89c678752fa793a4d9
SHA16cef51d6765edde38cae991b3894c885be8021de
SHA256b85536ecd1f270243500a9854c58979fa5091b578923ca3104c40b2ea455ce19
SHA51281955b9a211fe8813c164cf436470e46ebfb9b7f4b68eef29feeb21edfb37219f553295fc6cbaf861a3d44f7b37aaab07c48df5abeb76c0c07d3a1b57f82bb32
-
Filesize
84KB
MD5348571f83a0961b5fb0481546adf4406
SHA1692eb0464fdd84c75735bfdc9f1118593faed7f2
SHA2566f47e42ef2ff66d1e41e903200f528e24b8d84918f27e51613d5f04606aedb25
SHA51219cba134fa80f4992f7264eaeee0bd94e84650e0cc091962e8239c2fc2ce561313f0d4ebda2014250d3c50fbf5b419aa55fcbc35145aafcfeaeeae28d88fbb0f