Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 05:25
Static task
static1
Behavioral task
behavioral1
Sample
76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe
Resource
win10v2004-20220812-en
General
-
Target
76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe
-
Size
82KB
-
MD5
1fa08df0bd4d31d285ba50fedf5f11a6
-
SHA1
67ae27c49e411d6ca83d95811db46adf8ecf1e40
-
SHA256
76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc
-
SHA512
9e40d683dd9bd5aec0f645bdad36b3003125a07998b1b25ec69cc9fe392b8bf4db405c98aeec191271de63e809bb9aa6ac1a07884a544d64c2e315ad7595c360
-
SSDEEP
1536:R6KDqIaiMHQC4DGjP5dEINWu7ajYEYGMe0mN+CkjvHjnyppguRQxg+HdU/cO0:R6KgiCQC4DGTDD5ajYErKmNo7nKpDitp
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000502392b04cefc384cf056f8953d0f5a55fe3ad8fb8d7ccc5660b75529e97085a000000000e80000000020000200000008b88ed987eb5ee638102ff5ff65de670852aafa699dd4f14e013760847fe52ab2000000068afd787da4b525c450431646f7e41de7141db540f2d6ea12c1a077d6ca158ab40000000fbe304c75066b757eb275a510334e48967bd9554d81e43d38ecd7efcfa7bbf357f5d2dd4bacc81c64bb955eaa7c23c071b96e76d8d3c0f5dd0aeb97b8080602a IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000001a0339a312642a7bd0614ab5e95dd67abfd41a56827b2f9e6f55068e365cbd9d000000000e800000000200002000000058a1b2943490ec483033e01b2a636c85f82db9b5587d187ff31860e1cbe926f520000000485efad8d997c106a5bbd122a4ef97fb93a02e46e59eca82807dbb63862f5e4740000000a046e619f53ffa661cec2c97f67d88c7e1b0aacdb9ecef0ff85e57f108a97bf4b7e8cf9f3e8e2fe02f38376c579c438c46530b6b58ea7a4ae1c3c4a967c9d9c4 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100970160accd801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{24096AF8-37FD-11ED-89AC-5E3721E937B7} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c60c0d0accd801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370344579" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985225" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4175315108" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4195315732" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985225" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4175315108" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985225" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE 3796 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4320 wrote to memory of 2432 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 81 PID 4320 wrote to memory of 2432 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 81 PID 2432 wrote to memory of 3796 2432 IEXPLORE.EXE 82 PID 2432 wrote to memory of 3796 2432 IEXPLORE.EXE 82 PID 2432 wrote to memory of 3796 2432 IEXPLORE.EXE 82 PID 4320 wrote to memory of 1260 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 83 PID 4320 wrote to memory of 1260 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 83 PID 4320 wrote to memory of 4600 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 84 PID 4320 wrote to memory of 4600 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 84 PID 4320 wrote to memory of 4600 4320 76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe"C:\Users\Admin\AppData\Local\Temp\76fae8a7dec7c67735e3ed64467ca5eb58ae13f0fd7af2f812fbdbef3a59c6bc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.on86.com2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3796
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.xingkongjisu.com/flashplayer.htm?52c2⤵
- Modifies Internet Explorer settings
PID:1260
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\76FAE8~1.EXE2⤵PID:4600
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD51520b1f0e8660cc8553264ce46871efd
SHA170c43f2c0b7599f782461590f8e1650a2df5dbfe
SHA2568bb8dd5446da57093db31c10b4093a2378a9324f137d3eaa21ab0027e191c09e
SHA5126ad8d5f620738988286981654070c9a4e2542f629f4e5245381143a2a88c98922145759ff8d90546e1a617639a7dd335ddca4aba5435fb216c01c705bc4f0be0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD57e344aac8753b8d88ecc4ef453c5a627
SHA1ecf2507e74e5ad36d0106f73bc25c57b25ec7738
SHA256b92f4b0db8ff91f8d74e83eb19419a7e610f7dd64e0c86d2df5f01859beda583
SHA512d5a4099febf69e9cf1869777401dfa82021301d25049fd8b3cf65699161f530f57bd49d85255d4765f237dadf23300042407742d77a1e6eba788b327252555b5