Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
14b056c577bb2f2132ea6afa84e1b9229238f2e99068648bfcc2917139d92256.xml
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
14b056c577bb2f2132ea6afa84e1b9229238f2e99068648bfcc2917139d92256.xml
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
14b056c577bb2f2132ea6afa84e1b9229238f2e99068648bfcc2917139d92256.xml
-
Size
28KB
-
MD5
6a5cedda9f0022ac7378b8694e3d64f4
-
SHA1
b3d9e005db9b71d1aa457c32ad96832763fa6162
-
SHA256
14b056c577bb2f2132ea6afa84e1b9229238f2e99068648bfcc2917139d92256
-
SHA512
b40c89458f99a16143f319737527bc127cc0e84441629e52b1d47e3137965262cdef2f66758b9c2c3fabd41460d243e7a097a7e8cbd13d93f6f553679bb893db
-
SSDEEP
384:tTigZJtl/df3u0x2w6s4w6seRagQ4pAS9qgtgcVfrqLFtx0:tTZdW0p7p7OQqFbXrqL/x0
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370371804" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000045181dea17cc9a101ae86f6ab8fcafe0579f741520e5136fb1a9261192e55045000000000e8000000002000020000000d312fe5303729afbb5b75a76e8ae530627d50632f54b2445dadea9e065342b0c200000005c36c15dd4e6c531eeaad110018c048568b3aeb7c8272fade1c2f828ef56e11d4000000049683d1485d7f900d2904700819c6a7586d80533ba2703e4e5b700757f0673a386d185dd271564796a277aa357193f1ea07abbc743362097eea71fcfe5ceb2ff IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C72DAE1-383C-11ED-9351-5A21EB137514} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000023630eb076cdaeb0476c2905eb2e4a208534553b27740122e3d855a5507b6327000000000e8000000002000020000000ff98bf8218aa985bec3a91cecb2aa5c26f07149aa853acb9969bb2ee4cb6710b90000000c6e38e86d22259d3e1fbe2849ef99cffa3b349619f074bd45bedc30c045b9cea32f5ab124d9610081400ac0e60af7238f35be9c43ac663ee002b4b3bb3e1894b4fbf27c328bf74f82893a066faef88f5bd9ec754cb2edbb005b11b3f373f74455be847fae3d2e8ae2a35beebecc8a8cf32074d9257ba6226aa29cfdebe2fc41ab9469856e6283b8df8743c1232954f1f400000006022e728e2c90297056cc173ef3fb9d4e9fccca4153e180e4bab39c9fc14dcd7a1e74ecd203eb52230db592e65cb493aa6ed5262b404e05386bc9a06a34b8ceb IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ec236249ccd801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1404 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1316 1632 MSOXMLED.EXE 29 PID 1632 wrote to memory of 1316 1632 MSOXMLED.EXE 29 PID 1632 wrote to memory of 1316 1632 MSOXMLED.EXE 29 PID 1632 wrote to memory of 1316 1632 MSOXMLED.EXE 29 PID 1316 wrote to memory of 1404 1316 iexplore.exe 30 PID 1316 wrote to memory of 1404 1316 iexplore.exe 30 PID 1316 wrote to memory of 1404 1316 iexplore.exe 30 PID 1316 wrote to memory of 1404 1316 iexplore.exe 30 PID 1404 wrote to memory of 1484 1404 IEXPLORE.EXE 31 PID 1404 wrote to memory of 1484 1404 IEXPLORE.EXE 31 PID 1404 wrote to memory of 1484 1404 IEXPLORE.EXE 31 PID 1404 wrote to memory of 1484 1404 IEXPLORE.EXE 31
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\14b056c577bb2f2132ea6afa84e1b9229238f2e99068648bfcc2917139d92256.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD57a2ae9b70c3d621d739c1a3b805ae2c6
SHA13bd12a48b1f0c44f08911d325e34b9d98d31990d
SHA256b7f5f065e3e394673cdc1d40895730f550af60b002b0a5a16a72fc58f7ed0aeb
SHA5122936bbdd3d6d50fd58d3a14b0db1c3c6d40e846c10d5f433a962f7164dee87f43edff88268b4bb7759b27ed7d4a1d8ec9b66a5210679b27ffb79d93e5ec001d9