Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
10/07/2020, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
l1o2c3o4m5o6t7i8v.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
l1o2c3o4m5o6t7i8v.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
l1o2c3o4m5o6t7i8v.exe
-
Size
453KB
-
MD5
ecee3f4d2b76bd477d527ab4afb664e0
-
SHA1
4939e3539b20d667bfc0803f9997065cd58e64be
-
SHA256
f4c0e5c6f0deef58b93fb675108501bdffca205910f15253fe007a399532d6e5
-
SHA512
76f314e0b6ff412022b5b49575ff6e09068086e940e2c0264aa91814fb8e4e65fcd2e35d6287e70972569ac4e179679b0c3e90f2e066313e8df823af56f4b4c7
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 1516 iexplore.exe 1516 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1516 iexplore.exe 1516 iexplore.exe 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1516 iexplore.exe 1516 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1516 iexplore.exe 1516 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1516 iexplore.exe 1516 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1516 iexplore.exe 1516 iexplore.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1516 iexplore.exe 1516 iexplore.exe 1516 iexplore.exe 1516 iexplore.exe 1516 iexplore.exe 1516 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ACC4FD1-C251-11EA-8E31-CE94C9E5ACDD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab8000000000200000000001066000000010000200000009a0adabc639f9c74079830767ca301a305bda8649d099eef54547768eef8fb72000000000e800000000200002000000038349f885889a0624015e70bbd4a3ac8f476b79e3063f3065ae5fe7d362dd0ed20000000fb9048513f6a510a7ed57ac89c216ef1d87d172d96dd195c9c7c5df1fdc9365140000000a04b49154c1c61e8129f9a7253ca3bc67c614daabfc786eda449388551f9617ee98fc08d6c6c1f7c38ea1617999c5539adf58606b2a5782ee80ab5630110b7ac iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d50c665e56d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "301111608" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab800000000020000000000106600000001000020000000d1257f86992e7490c95838b3a0a0533a707018d84374c440a6a8bd477a214153000000000e800000000200002000000035a57c89876adde2e2dbadb6daefc633725a7cd155f499c5dc24b3c3939f60bb90000000d7ff03e64e208a775f5b2c8db51b4ae369d3387c0d60b8f26c2346140bec452380aab57c953703c7ae43d25b744f8b7da58662857b484b34df91d6f7065cb4d6b209c30da759778f791e71ff1ad60bec21b64b2ff509298a70ef88831ae3857c8036ad4eefee23a02ec74e8a585145b65497d921bf4772a3a666c3ddd1253f71cab646ae1b1c8247b4481d668fae5363400000003890de8131f44f1cadaa98cedb11f26134c496eeb8dd0cd83908c2c3531c8a00d8b22ab873ddfc8bae809184f5e6e5c20e40f23c3c60790fa45869844bd46d0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Checks whether UAC is enabled 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1868 1516 iexplore.exe 28 PID 1516 wrote to memory of 1868 1516 iexplore.exe 28 PID 1516 wrote to memory of 1868 1516 iexplore.exe 28 PID 1516 wrote to memory of 1868 1516 iexplore.exe 28 PID 1516 wrote to memory of 1580 1516 iexplore.exe 30 PID 1516 wrote to memory of 1580 1516 iexplore.exe 30 PID 1516 wrote to memory of 1580 1516 iexplore.exe 30 PID 1516 wrote to memory of 1580 1516 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\l1o2c3o4m5o6t7i8v.exe"C:\Users\Admin\AppData\Local\Temp\l1o2c3o4m5o6t7i8v.exe"1⤵PID:1464
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
PID:1868
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275468 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
PID:1580
-