Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe
-
Size
381KB
-
MD5
026967df99c1e939598519cfc3dfb171
-
SHA1
94810d1e09daa858b37bc21922c61ba1469979b2
-
SHA256
0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316
-
SHA512
8a0dc0e98aded5c069363d2cbba49b26a07c90beba06b2bb45d7431fb456e3709ccd05b2b6f0ddf29257ff67171c9381f254c0b297e0732b178114488c8d2729
-
SSDEEP
6144:AIODqYV/MzkO8RxRltwvwv++euoRqnhmXjyZroNJQsdWdc+hdhQLV:AIO2gJl+q+TRDTyZMctCR
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3680 set thread context of 2280 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 86 PID 3680 set thread context of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371441337" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987779" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2551780937" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C3908B15-41F6-11ED-A0EE-E6AF42CF752C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2551780937" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2562249348" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 2280 iexplore.exe 2280 iexplore.exe 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3680 wrote to memory of 1972 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 85 PID 3680 wrote to memory of 1972 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 85 PID 3680 wrote to memory of 1972 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 85 PID 3680 wrote to memory of 2280 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 86 PID 3680 wrote to memory of 2280 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 86 PID 3680 wrote to memory of 2280 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 86 PID 3680 wrote to memory of 2280 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 86 PID 3680 wrote to memory of 2280 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 86 PID 3680 wrote to memory of 2280 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 86 PID 1972 wrote to memory of 1228 1972 cmd.exe 88 PID 1972 wrote to memory of 1228 1972 cmd.exe 88 PID 1972 wrote to memory of 1228 1972 cmd.exe 88 PID 1228 wrote to memory of 1184 1228 net.exe 89 PID 1228 wrote to memory of 1184 1228 net.exe 89 PID 1228 wrote to memory of 1184 1228 net.exe 89 PID 2280 wrote to memory of 1932 2280 iexplore.exe 90 PID 2280 wrote to memory of 1932 2280 iexplore.exe 90 PID 2280 wrote to memory of 1932 2280 iexplore.exe 90 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91 PID 3680 wrote to memory of 1220 3680 0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe"C:\Users\Admin\AppData\Local\Temp\0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1184
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
-
C:\Users\Admin\AppData\Local\Temp\0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exeC:\Users\Admin\AppData\Local\Temp\0bde70cdea5b77fd8f0b234b0aa6cd2dbf0ce533f2e476665d6ed3bec1331316.exe2⤵PID:1220
-