Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe
Resource
win10v2004-20220812-en
General
-
Target
db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe
-
Size
192KB
-
MD5
6b3520071c2bce8966480db5eb206250
-
SHA1
63f8d183b3a863688746b94ec2ef442e47bf8270
-
SHA256
db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b
-
SHA512
ce8054d177fed61c5465ef23c0431a2aa5695b0b8b1c33d9584ead358302b2221461096d0b65ef27da4a4f686dd8388ece52d166eec1c3fd7a410ebc79393e62
-
SSDEEP
3072:kXhEZlPc/EQv36BO7YfITv2xQi9Zl7IXMII4t4rKgBzDShnzRqC6UwFr+og:guPQ6O7YfQri9TIXoFBzehVmHFM
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 620 set thread context of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371489699" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59B7A651-4267-11ED-BE8B-FAA138970F28} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe Token: SeDebugPrivilege 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe Token: SeDebugPrivilege 2040 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 552 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 552 IEXPLORE.EXE 552 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 620 wrote to memory of 1708 620 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 27 PID 1708 wrote to memory of 1904 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 28 PID 1708 wrote to memory of 1904 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 28 PID 1708 wrote to memory of 1904 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 28 PID 1708 wrote to memory of 1904 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 28 PID 1904 wrote to memory of 552 1904 iexplore.exe 29 PID 1904 wrote to memory of 552 1904 iexplore.exe 29 PID 1904 wrote to memory of 552 1904 iexplore.exe 29 PID 1904 wrote to memory of 552 1904 iexplore.exe 29 PID 552 wrote to memory of 2040 552 IEXPLORE.EXE 31 PID 552 wrote to memory of 2040 552 IEXPLORE.EXE 31 PID 552 wrote to memory of 2040 552 IEXPLORE.EXE 31 PID 552 wrote to memory of 2040 552 IEXPLORE.EXE 31 PID 1708 wrote to memory of 2040 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 31 PID 1708 wrote to memory of 2040 1708 db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe"C:\Users\Admin\AppData\Local\Temp\db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe"C:\Users\Admin\AppData\Local\Temp\db5f71d6ddbb8ae6620e92841f584c13dfd6b36185f23255d29860a81b19157b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5fe4237eae6542213e30be7040b7af023
SHA1fe9a8f78b9ac16f92a2f3c3cb5704ec414d30d3d
SHA256a5e173bd1b5f1aadb3ea3fd8039ad425506afe2c95b970466124785c2d49d7ce
SHA512cdcb1ad1c828912c937e372f1b82b06add7c95ec9fe6c57d172cfb618cf4f173cb87b67284cb62ee0956e61283f6f61b3743723731897e0b6981b16442c294a9