Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe
Resource
win10v2004-20220901-en
General
-
Target
7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe
-
Size
45KB
-
MD5
e0ddc5a92588944321f3511bf9604871
-
SHA1
f79068d7347f89b63f1bf837fd6ecd7c3d527a94
-
SHA256
7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194
-
SHA512
732a54d0038e8c79230c38a14ab10247903a9298df518720f32e8f3a9546a411b8feeb3ccee37b15af66b46c9a9eee4831bf9a1de958da808ccf34a6f1599ae7
-
SSDEEP
384:/TqAGvv+2smXWnECTiJgpS08tEnkphMFNbaX32llzT7E3RXYbNFCBpHD/4nKi8h2:/gR82gIQiSNbaX32llzT7gRcEdwY1ce
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1912 set thread context of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 2012 set thread context of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d6f5f051ccd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000049d3c1f6851fbb9b97f488da1fa1bba105babec4a33bc9588ae7dca7efd32e1d000000000e8000000002000020000000bbbb3ec25a6a1858e081af69cc9257758adeb20c6253febd6f4bd68292717ebb20000000e27d3fa03389b5537ada4f6cbefc99003c8f6d67189f785d5ca98b04c1fb607040000000e8e6c002984c3ac4ca6a829659771f922ac84f0eb414080c4a028a8da916bfc51f8fd255b77cb4c130e05259004f26a53aef9d56b309943cdcfaa08a1812c847 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000097c17d761aeb34e3ba69f500c9b587fd12e0a98c9f8697ddb3d8f552a7069f4f000000000e80000000020000200000009cd117155ef3588ee853124a8683506c6c25dd30ec2e0138c6921e12d0919cd1900000003323e003386717bc48b8d6c24663c027ff6d2ea7e41064b8ef21b0a13c7cd7c53bfc1851a6cfc32556aa029395dd704793c4a6508bc6d7ad7409da1bebaa5ce53898f9a98a3b07fff68ca73577ff692b756cb034c25dc8bdbb34be7fcea423d0b108072088abdd24eb126ba3a4b52886864a27bd0277864e48fcb3ed808ed92318b4f99e49b13ae5fd5c70fcdd9c187c40000000d03c208657db465343e5a1f52f068fe65bbb1b7b3074ebb10e77e513762e14c888eee88aeeb715f035176171a314c74d19edf77d5669ce36b00aac09a454007c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370375471" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A398EC1-3845-11ED-8B55-6651945CA213} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 980 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 980 iexplore.exe 980 iexplore.exe 1780 IEXPLORE.EXE 1780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 1912 wrote to memory of 2012 1912 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 28 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 2012 wrote to memory of 1752 2012 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 29 PID 1752 wrote to memory of 980 1752 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 32 PID 1752 wrote to memory of 980 1752 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 32 PID 1752 wrote to memory of 980 1752 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 32 PID 1752 wrote to memory of 980 1752 7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe 32 PID 980 wrote to memory of 1780 980 iexplore.exe 33 PID 980 wrote to memory of 1780 980 iexplore.exe 33 PID 980 wrote to memory of 1780 980 iexplore.exe 33 PID 980 wrote to memory of 1780 980 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe"C:\Users\Admin\AppData\Local\Temp\7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe"C:\Users\Admin\AppData\Local\Temp\7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe"C:\Users\Admin\AppData\Local\Temp\7b9ac14b26a3fbef7acf2f6718fd74de2c8ece221d31f11b27db278f79cb1194.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://sharecash.org/download.php?file=16145144⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:980 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD525a0e6a2590df6b5edefa0f51d214261
SHA18bbd2395db43b9838626eda00ca0acf6e822b94d
SHA2563b979d97345639f940b7ac6231e25ae41cdaf7f6d851f482f3be4a6aeb8007d6
SHA512c892cea34b5d68c293b8d8e71ad24d8a33094d0a7ca182c7931bc2f0a2c654c134269f3112e2902fa2f18b9c29e1d1288c141928944b0958e198bed941af8afb
-
Filesize
598B
MD5c7f980681891b12d8e26c45252a214c2
SHA1eae0b06b66790f101557f8c4dfd0df7d5d7f6575
SHA256021ee2a53a35b2afc5c9bc382c624adf38def9e012faa8e045ba60c21fdcd1bb
SHA512ac0f995e53b2bb61625dee9a5d14dd6f99b2e3d1cb528dd7ae780c445cc5d2764f52ad2305ff978200859afde2285a0c145be0ea8339b8bcc7fbd0cf781dfbfa
-
Filesize
2KB
MD525a0e6a2590df6b5edefa0f51d214261
SHA18bbd2395db43b9838626eda00ca0acf6e822b94d
SHA2563b979d97345639f940b7ac6231e25ae41cdaf7f6d851f482f3be4a6aeb8007d6
SHA512c892cea34b5d68c293b8d8e71ad24d8a33094d0a7ca182c7931bc2f0a2c654c134269f3112e2902fa2f18b9c29e1d1288c141928944b0958e198bed941af8afb