Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 21:25
Static task
static1
Behavioral task
behavioral1
Sample
5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe
Resource
win10v2004-20241007-en
General
-
Target
5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe
-
Size
96KB
-
MD5
f6af899858cc960551e9995bc7b630bc
-
SHA1
1c4d2e3930df683f5246a6a7b784858af158d030
-
SHA256
5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5
-
SHA512
820d325b1cb65a5ecd4a5694206704969be80b4acf5ce0bed9c636c5cdea9481d718e8b226e1106193f6ea350197a89473e5e1a6b2cac567e435bb7c1922a7e5
-
SSDEEP
1536:ZiHQSinmxLxd2xLq7106AlYIG5/jp34FOgJduV9jojTIvjr:ZsXxltI+Lp8Jd69jc0v
Malware Config
Extracted
berbew
http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgfkmgnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgfkmgnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Djdgic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Dnpciaef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cegoqlof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cegoqlof.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djdgic32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnpciaef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe -
Executes dropped EXE 5 IoCs
pid Process 1376 Cegoqlof.exe 1732 Cgfkmgnj.exe 2804 Djdgic32.exe 2592 Dnpciaef.exe 2612 Dpapaj32.exe -
Loads dropped DLL 13 IoCs
pid Process 2088 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe 2088 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe 1376 Cegoqlof.exe 1376 Cegoqlof.exe 1732 Cgfkmgnj.exe 1732 Cgfkmgnj.exe 2804 Djdgic32.exe 2804 Djdgic32.exe 2592 Dnpciaef.exe 2592 Dnpciaef.exe 2864 WerFault.exe 2864 WerFault.exe 2864 WerFault.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\ÿs.e¢e Dpapaj32.exe File opened for modification C:\Windows\SysWOW64\Cgfkmgnj.exe Cegoqlof.exe File opened for modification C:\Windows\SysWOW64\Dnpciaef.exe Djdgic32.exe File created C:\Windows\SysWOW64\Dpapaj32.exe Dnpciaef.exe File opened for modification C:\Windows\SysWOW64\Djdgic32.exe Cgfkmgnj.exe File opened for modification C:\Windows\SysWOW64\Dpapaj32.exe Dnpciaef.exe File created C:\Windows\SysWOW64\Djdgic32.exe Cgfkmgnj.exe File created C:\Windows\SysWOW64\Ccofjipn.dll Cgfkmgnj.exe File created C:\Windows\SysWOW64\Dnpciaef.exe Djdgic32.exe File opened for modification C:\Windows\SysWOW64\ÿs.e¢e Dpapaj32.exe File created C:\Windows\SysWOW64\Cegoqlof.exe 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe File opened for modification C:\Windows\SysWOW64\Cegoqlof.exe 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe File created C:\Windows\SysWOW64\Cpmahlfd.dll Cegoqlof.exe File created C:\Windows\SysWOW64\Pdkefp32.dll Dnpciaef.exe File created C:\Windows\SysWOW64\Nloone32.dll 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe File created C:\Windows\SysWOW64\Cgfkmgnj.exe Cegoqlof.exe File created C:\Windows\SysWOW64\Pmiljc32.dll Djdgic32.exe -
Program crash 1 IoCs
pid pid_target Process 2864 2612 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cegoqlof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cgfkmgnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djdgic32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnpciaef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dpapaj32.exe -
Modifies registry class 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpmahlfd.dll" Cegoqlof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cgfkmgnj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djdgic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll" Dnpciaef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nloone32.dll" 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717} 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cegoqlof.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cgfkmgnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccofjipn.dll" Cgfkmgnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmiljc32.dll" Djdgic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cegoqlof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Djdgic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dnpciaef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Dnpciaef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1376 2088 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe 31 PID 2088 wrote to memory of 1376 2088 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe 31 PID 2088 wrote to memory of 1376 2088 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe 31 PID 2088 wrote to memory of 1376 2088 5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe 31 PID 1376 wrote to memory of 1732 1376 Cegoqlof.exe 32 PID 1376 wrote to memory of 1732 1376 Cegoqlof.exe 32 PID 1376 wrote to memory of 1732 1376 Cegoqlof.exe 32 PID 1376 wrote to memory of 1732 1376 Cegoqlof.exe 32 PID 1732 wrote to memory of 2804 1732 Cgfkmgnj.exe 33 PID 1732 wrote to memory of 2804 1732 Cgfkmgnj.exe 33 PID 1732 wrote to memory of 2804 1732 Cgfkmgnj.exe 33 PID 1732 wrote to memory of 2804 1732 Cgfkmgnj.exe 33 PID 2804 wrote to memory of 2592 2804 Djdgic32.exe 34 PID 2804 wrote to memory of 2592 2804 Djdgic32.exe 34 PID 2804 wrote to memory of 2592 2804 Djdgic32.exe 34 PID 2804 wrote to memory of 2592 2804 Djdgic32.exe 34 PID 2592 wrote to memory of 2612 2592 Dnpciaef.exe 35 PID 2592 wrote to memory of 2612 2592 Dnpciaef.exe 35 PID 2592 wrote to memory of 2612 2592 Dnpciaef.exe 35 PID 2592 wrote to memory of 2612 2592 Dnpciaef.exe 35 PID 2612 wrote to memory of 2864 2612 Dpapaj32.exe 36 PID 2612 wrote to memory of 2864 2612 Dpapaj32.exe 36 PID 2612 wrote to memory of 2864 2612 Dpapaj32.exe 36 PID 2612 wrote to memory of 2864 2612 Dpapaj32.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe"C:\Users\Admin\AppData\Local\Temp\5c36123ba64d0da237b6dc207613f1997dea23260746945cfddb26f9cf01b7d5.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\Cegoqlof.exeC:\Windows\system32\Cegoqlof.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\Cgfkmgnj.exeC:\Windows\system32\Cgfkmgnj.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Djdgic32.exeC:\Windows\system32\Djdgic32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\Dnpciaef.exeC:\Windows\system32\Dnpciaef.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\Dpapaj32.exeC:\Windows\system32\Dpapaj32.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1447⤵
- Loads dropped DLL
- Program crash
PID:2864
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD58d0f7a51d3ea9dcc968f45fbf6fd108e
SHA107d6d79923c00a3c53259ab7d244b24b6c076907
SHA256d88296ada8d581c57db4384e9c1db7b9029f78415b0a1927d2ae928df9fad2f7
SHA51294a2e5d6b105a98087b849f4e72cd7b9063a43cae3a53bfb78ad850273000abaef7704ee57f002a67a3b0d34dcab8458b55cd1b849c047f3cbe202b82bd6726b
-
Filesize
96KB
MD58b756e2ce98881b5bbc42df390f2eaeb
SHA19f9ae3d9aa77662b612d74e4379ed91035789d14
SHA256ac9131e0cbf7d94c77b1f1551ee5b9e0d7bad5cfc1afcb4c8899c0b3fdc13151
SHA51245b24475d7ceb0c98a6bcb7136071cc6cb85b8ad7ac0afbfaacdc69867a26c862c34aa312a7fc0be71b907e3e45a0235e2c9c3e3cb5976376bbfdaa81b4206d1
-
Filesize
7KB
MD571dd60db071c86e07af5d054dfc05c92
SHA1bf0fd30585ca8cece58d71c85073ea84b9bde0df
SHA256079a646d0f5ea406dce332e1cb2915956e4f0799e944839525b75ccf2149374a
SHA512b2f3bd296201b5189745fb106005db2eb7d3c649d0243942b749085d1483c709180a15d945f2e4f27b11ed300753cc3be759cbc3e0712654802155c732e87617
-
Filesize
96KB
MD5fc4b8e93bb81b683509ec2f3e6f4e133
SHA1bef766fa4b7ed50a395ec2b65bd2a73e2807d4db
SHA256f3382521fc88ebc84bee554fe3386d7b033a4fe41963304964b370bc5b782843
SHA512d207aec783150847e9e3086f0e322ec5932d5e728e0d4dca9f6427debcc1e8e71f88a8e33d4de65df0b132d0bd47e5d97f3de2b058c508477545b1ef831d9e75
-
Filesize
96KB
MD530d957b2f0a55afb9ae2bafec9d6f604
SHA18fedfba7e145bcc2181e9981b6be76b61015e1e6
SHA2568652e389c17cc36c3b3755a3ed4a9a277f1816d5aefc8c3d6570c0dfa0cc9b46
SHA512f18b1f79fcbb29f68edf5fdfb2e2e6839cfd36e5e49abeceee5111cc9228575eeb0c02e1159072270af84af6a32017271e2142340eda381c69107102583c8ebf
-
Filesize
96KB
MD50925f767c79fa218e2468939ed6fa534
SHA1b5d5cf31a98be2f440bf15ec2dcdfa147eb39648
SHA2562bbd7dd136fa18b0bb46dd64c8d3d0ba5bcc41d9435ce70c83e355c8754fad91
SHA51230407a9da4ae267211cf3381763b6e18c82a74b0fd96f2101295494e3cc2ba617e5e3188c2dc81a080e9cc0f56a4077a48815f366c7778e22473b4f8ad8d64cc