Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
submitted
22/08/2024, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe
Resource
win10v2004-20240802-en
General
-
Target
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe
-
Size
80KB
-
MD5
a5cd8fc525b13f71b9051df0df4c81bc
-
SHA1
b03143816c1bce1584a7b010049ccaf1bb61b539
-
SHA256
1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0
-
SHA512
4d565650babf1c64299fa8d917e1c0e4cdd15820fde47891f5a8e027f260b6e731fbad0d3636e5bb239a0df2b6669b453c044857b9967311e47b7c2efefb038b
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOTpas:GhfxHNIreQm+Hispas
Malware Config
Extracted
qqpass
http://www.zigui.org/article.php?id=103822
-
url
http://www.mxm9191.com/myrunner_up.exe
-
user_agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Signatures
-
Qqpass family
-
Executes dropped EXE 1 IoCs
pid Process 856 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File created C:\Windows\SysWOW64\¢«.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe File created C:\Windows\system\rundll32.exe 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1724316017" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1724316017" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 856 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 856 rundll32.exe 856 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3960 wrote to memory of 856 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 94 PID 3960 wrote to memory of 856 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 94 PID 3960 wrote to memory of 856 3960 1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe"C:\Users\Admin\AppData\Local\Temp\1796369efda4442ef49a2806580302388e3013e0f118741ef545dd7a32ec7ce0.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:81⤵PID:1496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5800ba13f1084005a0c342b57b336f553
SHA1ed3b26a786b2c1253d8d9e92b4e7b305903940ee
SHA25659a7b194cb160bf92f2d5318de0339bc508dce44a3184a715fbd755181acfca8
SHA5129cfccbca09c4337874783e689fc88a949e5838216a3594be74ecec16c345c192ef2fd4000d016eaef9a24977639dc87c5e40a5ee4e3d5ad7223c8a193b8613cf
-
Filesize
81KB
MD552c6df7b45a1492ee2a73338b61d6a13
SHA134e89928321f061370519d2038378cc553aea4be
SHA2565ba2ef08d621826a93b868207bea0100329824fa4b8bd2d80ad832c18a9780fe
SHA5126eefce8adb290416c0ba25c961c89ef276c930e4b8d1a60bfbd2b24ba141ccb10590033a3565540409401f1cb2c7adde04cfbb16ec4e4751862ac35e842eac8b