Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe
Resource
win10v2004-20240802-en
General
-
Target
6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe
-
Size
72KB
-
MD5
3fcda792b467b172ce3154fe3ad0166d
-
SHA1
ff2a8577f7a406878a4172b9b1ac9054b9c156b4
-
SHA256
6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c
-
SHA512
a56f6999aaa547ae311f05637895045c9b4bc413e4b6055830713acacac9cea70d54962deabed52f9be5dbbd2ab55b005762e097104c49c7d776403e1e455a38
-
SSDEEP
768:88B81RAC+HQecWpLiprTXqVmRM2g60Rqjh21EWn/1H58ZuT+U9UiEb/KEiEixV3T:XimweppSr2oMg0Rqj25jDPgUN3QivEtA
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cinfhigl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmgechbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmgechbh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdanpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdanpb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cinfhigl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cphndc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cphndc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdoajb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cdoajb32.exe -
Executes dropped EXE 6 IoCs
pid Process 2912 Cdoajb32.exe 2896 Cmgechbh.exe 2404 Cdanpb32.exe 2620 Cinfhigl.exe 2984 Cphndc32.exe 1060 Ceegmj32.exe -
Loads dropped DLL 16 IoCs
pid Process 2720 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe 2720 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe 2912 Cdoajb32.exe 2912 Cdoajb32.exe 2896 Cmgechbh.exe 2896 Cmgechbh.exe 2404 Cdanpb32.exe 2404 Cdanpb32.exe 2620 Cinfhigl.exe 2620 Cinfhigl.exe 2984 Cphndc32.exe 2984 Cphndc32.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lopdpdmj.dll Cinfhigl.exe File opened for modification C:\Windows\SysWOW64\Cmgechbh.exe Cdoajb32.exe File created C:\Windows\SysWOW64\Gnnffg32.dll Cdoajb32.exe File created C:\Windows\SysWOW64\Cdanpb32.exe Cmgechbh.exe File created C:\Windows\SysWOW64\Cinfhigl.exe Cdanpb32.exe File created C:\Windows\SysWOW64\Ceegmj32.exe Cphndc32.exe File opened for modification C:\Windows\SysWOW64\Cphndc32.exe Cinfhigl.exe File created C:\Windows\SysWOW64\Cdoajb32.exe 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe File created C:\Windows\SysWOW64\Cmgechbh.exe Cdoajb32.exe File opened for modification C:\Windows\SysWOW64\Cdanpb32.exe Cmgechbh.exe File created C:\Windows\SysWOW64\Aincgi32.dll Cmgechbh.exe File opened for modification C:\Windows\SysWOW64\Cinfhigl.exe Cdanpb32.exe File created C:\Windows\SysWOW64\Cphndc32.exe Cinfhigl.exe File opened for modification C:\Windows\SysWOW64\Cdoajb32.exe 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe File created C:\Windows\SysWOW64\Dnabbkhk.dll 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe File created C:\Windows\SysWOW64\Mblnbcjf.dll Cdanpb32.exe File opened for modification C:\Windows\SysWOW64\Ceegmj32.exe Cphndc32.exe File created C:\Windows\SysWOW64\Aoogfhfp.dll Cphndc32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 576 1060 WerFault.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdoajb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmgechbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdanpb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cinfhigl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cphndc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ceegmj32.exe -
Modifies registry class 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmgechbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mblnbcjf.dll" Cdanpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoogfhfp.dll" Cphndc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cphndc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdoajb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aincgi32.dll" Cmgechbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cinfhigl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnabbkhk.dll" 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdanpb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cinfhigl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lopdpdmj.dll" Cinfhigl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnnffg32.dll" Cdoajb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cphndc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cdanpb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cdoajb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmgechbh.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2912 2720 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe 30 PID 2720 wrote to memory of 2912 2720 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe 30 PID 2720 wrote to memory of 2912 2720 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe 30 PID 2720 wrote to memory of 2912 2720 6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe 30 PID 2912 wrote to memory of 2896 2912 Cdoajb32.exe 31 PID 2912 wrote to memory of 2896 2912 Cdoajb32.exe 31 PID 2912 wrote to memory of 2896 2912 Cdoajb32.exe 31 PID 2912 wrote to memory of 2896 2912 Cdoajb32.exe 31 PID 2896 wrote to memory of 2404 2896 Cmgechbh.exe 32 PID 2896 wrote to memory of 2404 2896 Cmgechbh.exe 32 PID 2896 wrote to memory of 2404 2896 Cmgechbh.exe 32 PID 2896 wrote to memory of 2404 2896 Cmgechbh.exe 32 PID 2404 wrote to memory of 2620 2404 Cdanpb32.exe 33 PID 2404 wrote to memory of 2620 2404 Cdanpb32.exe 33 PID 2404 wrote to memory of 2620 2404 Cdanpb32.exe 33 PID 2404 wrote to memory of 2620 2404 Cdanpb32.exe 33 PID 2620 wrote to memory of 2984 2620 Cinfhigl.exe 34 PID 2620 wrote to memory of 2984 2620 Cinfhigl.exe 34 PID 2620 wrote to memory of 2984 2620 Cinfhigl.exe 34 PID 2620 wrote to memory of 2984 2620 Cinfhigl.exe 34 PID 2984 wrote to memory of 1060 2984 Cphndc32.exe 35 PID 2984 wrote to memory of 1060 2984 Cphndc32.exe 35 PID 2984 wrote to memory of 1060 2984 Cphndc32.exe 35 PID 2984 wrote to memory of 1060 2984 Cphndc32.exe 35 PID 1060 wrote to memory of 576 1060 Ceegmj32.exe 36 PID 1060 wrote to memory of 576 1060 Ceegmj32.exe 36 PID 1060 wrote to memory of 576 1060 Ceegmj32.exe 36 PID 1060 wrote to memory of 576 1060 Ceegmj32.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe"C:\Users\Admin\AppData\Local\Temp\6a8338119b242bcb67e56ddb1e1c1dfba3f3c65de780810d57367ddd3f6db97c.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Cdoajb32.exeC:\Windows\system32\Cdoajb32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Cmgechbh.exeC:\Windows\system32\Cmgechbh.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\Cdanpb32.exeC:\Windows\system32\Cdanpb32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\Cinfhigl.exeC:\Windows\system32\Cinfhigl.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\Cphndc32.exeC:\Windows\system32\Cphndc32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\Ceegmj32.exeC:\Windows\system32\Ceegmj32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 1408⤵
- Loads dropped DLL
- Program crash
PID:576
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5b2b4a44569c7f40c24e66fb7285f16d8
SHA17f36c85d37bfc383bd2344d8a484a09c05868c26
SHA25637eaa61b34d9cba2d90a16804e34c41a4193e96a87a0e8473fb90a274c598bf4
SHA512987b2518e0ce6d4b6974840895eebd6e68a777a8c44f492e464842a8b2d17feb54527e6e3251304772b853fc20827668f30fa3b41adb1bd8ff77611231492903
-
Filesize
72KB
MD5d199da1e313d259ed6afaea780cc9a24
SHA1672aa7b04087f2c08fcc76dd1752e6b2cbf07126
SHA25685f204ff18aaf8c87b8606af7d6242822ad53e8a728b2dbb35c702a65952da10
SHA512745b82f9b2ef6dd558430b51dd39c029069f28fb580a92f1e431c11599ae7340bbc08d4962a0e0b7bb6957b81b03c191da653bd9bfde7ec462cabf8d4d26980b
-
Filesize
72KB
MD542906dc2e977ff516a1221a0653abbfe
SHA19823e2b2aeb2f97f8650f41c18149b3bdc7a14ee
SHA256b8cfed0193a0be2b523c2f22ac2a626c66359493e7177b65a0ec4234cbd01f2b
SHA5123ec41f7a435384d6b1ef0ee36f463a6559411b850b77c1c1fdd485ee8dc0a078f0770977886874328ea0225c90aab7499be0e2c75a9e875bbd541388cef0fec0
-
Filesize
72KB
MD5e58ff940804da856d45294ba5cbda091
SHA15ad932cf29bc54d8868dc766565b8715eaf0ba3b
SHA256ea39ac1d1dffb4bca502fcc7f2dded048791ee26809ca81df3e86bae81a88f84
SHA5121af65bce0ce914b6fde6c4433941f706684376705249c89c2f8fcfdca4694f06c60032374e3eaf0ca3f98fa4a3da1a92f84529e115ead7ff10553f104d849b0c
-
Filesize
72KB
MD5e46ca492723fe4fa18f6e60133c28113
SHA146717e155786a35b2880f182c57d8251894f5888
SHA256590495b9089987f40055559d43de8ae5fbf778c2f2fdbfd2950ad76ec28d35d1
SHA5128e054ff8f0af9ad50f3e72838d3627296b68074c03f078e6d6ae34536cfe802604a3313887e130decb26a33fe667aff4d387c50658cef30d998f7b80b89b6a9b
-
Filesize
72KB
MD5efdd525d67cbb00985428bdfe45cfdf8
SHA17523651decd75b05979834ac43ced56b1e523258
SHA256e08db9d959c0f94a127fb714cc5921ff1322110ec44e7917c04a041f9f45c532
SHA51252ef4e5285242ee2e8cc55c69705ccd05c9a14c0488177cfa0c599db7ae8af953e7b29788652bd7a0adb0c71ab1ecc09e98d570031b1e1abc6d5138873a6d2c0