Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 18:22
Behavioral task
behavioral1
Sample
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe
Resource
win10v2004-20220812-en
General
-
Target
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe
-
Size
38KB
-
MD5
107a2e943ec481afc191f95abec83287
-
SHA1
2f3f05d1bf53272313bdefa0707383bef715dc00
-
SHA256
d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1
-
SHA512
60365d8db2797c6489d2ac1bef7347d13fa000b7eb84b8e864bcb69d92ab01c7b1993bdcfbba2667d345b16faa61dc57b3b15c5a23bb982bb136cda74bf25c3d
-
SSDEEP
384:/T/bkPtmZGS4xR+cXFQ0NYMXjnfdWrd+h/WNbbsxrvPVFEh7:/vEtmpiQ4YMzfdidDJgR/E9
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5044-132-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/5044-135-0x0000000000400000-0x000000000040B000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30985390" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cb67baaeccd801 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000764d65227d0fc75d37f64bce6fe230b4906c95e9fcb1427b33fe7be4ca3d2a55000000000e80000000020000200000002c1d9574f3bb2f8dc4d7066decb7d5fab478c4ce57ab55b0705ecf16a516f188200000006899d075b8c45827d778f7efeeb86decfeebd68ec432fefbac48329b2576cf6640000000dc9be1001ca3db2add6cc704a74c7275a05f3429cb9d7042e1c5b65eb0f63449e18ff2e07f5ceb1884a084fdedb5149907d2309131a6e9237d9a643b0cd694f0 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c79fb6aeccd801 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3127367229" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000008fb0efc0a6f435c004352437cf219de6162b0331dc6f57d201d74cb5e5895a6e000000000e8000000002000020000000d5a4d020d15c1a10ab6d0012d366181a9eba3c1badab37eb4b75fbf26536bf7c2000000073519f8d2c303046a40bac02aded3d1192b5de5f5eec40947f4fb889be37eda040000000a8d4c70cbd24ae7127813ef4177740f03bd087d8b77910c79f3d775b80a25fe4e8863800043f30c1d18731a1aa5131249495df3fd4d90c7132cb0ed7203691d2 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DEC429A7-38A1-11ED-B696-7ED4F7B3352B} = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30985390" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370415322" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3127367229" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4180 IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4180 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5044 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 4180 IEXPLORE.exe 4180 IEXPLORE.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5044 wrote to memory of 4180 5044 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 80 PID 5044 wrote to memory of 4180 5044 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 80 PID 4180 wrote to memory of 2248 4180 IEXPLORE.exe 81 PID 4180 wrote to memory of 2248 4180 IEXPLORE.exe 81 PID 4180 wrote to memory of 2248 4180 IEXPLORE.exe 81 PID 5044 wrote to memory of 820 5044 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 82 PID 5044 wrote to memory of 820 5044 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 82 PID 5044 wrote to memory of 448 5044 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 83 PID 5044 wrote to memory of 448 5044 d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe"C:\Users\Admin\AppData\Local\Temp\d0080cb09049fa35ad77cb757e5eaa730b8483e3657e8e58b1fa6b50023eeda1.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/Loader_jieku_977.html2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4180 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/haozip_tiny.200629.html2⤵
- Modifies Internet Explorer settings
PID:820
-
-
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.html2⤵
- Modifies Internet Explorer settings
PID:448
-