Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6.dll
Resource
win10v2004-20220812-en
General
-
Target
cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6.dll
-
Size
507KB
-
MD5
67e9c80dc1bc31549fbde95e082ec522
-
SHA1
589a0511a3fbdb2556d09941e2e3839a3ae1fef5
-
SHA256
cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6
-
SHA512
1ef0e9ea7be3e88e1a78e8afda3ee37c9011d433b669b26e42451173b94eff32017dcd2acc1df6e5c5236d2e97a9a478a6e0e43b29558bc02cfe765fc977841f
-
SSDEEP
12288:0MwVOnc2oPKebOm9J1s3TzhxQBNDnh3lINEKWA2:G0c24haEs3BuBNDnZihr
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6 = "rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6.dll,#1" rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371497688" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF952B41-4279-11ED-8DB1-7A3897842414} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1608 iexplore.exe 1608 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1608 iexplore.exe 1608 iexplore.exe 276 IEXPLORE.EXE 276 IEXPLORE.EXE 912 rundll32.exe 1608 iexplore.exe 1608 iexplore.exe 828 IEXPLORE.EXE 828 IEXPLORE.EXE 912 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1832 wrote to memory of 912 1832 rundll32.exe 28 PID 1832 wrote to memory of 912 1832 rundll32.exe 28 PID 1832 wrote to memory of 912 1832 rundll32.exe 28 PID 1832 wrote to memory of 912 1832 rundll32.exe 28 PID 1832 wrote to memory of 912 1832 rundll32.exe 28 PID 1832 wrote to memory of 912 1832 rundll32.exe 28 PID 1832 wrote to memory of 912 1832 rundll32.exe 28 PID 1608 wrote to memory of 276 1608 iexplore.exe 31 PID 1608 wrote to memory of 276 1608 iexplore.exe 31 PID 1608 wrote to memory of 276 1608 iexplore.exe 31 PID 1608 wrote to memory of 276 1608 iexplore.exe 31 PID 1608 wrote to memory of 828 1608 iexplore.exe 32 PID 1608 wrote to memory of 828 1608 iexplore.exe 32 PID 1608 wrote to memory of 828 1608 iexplore.exe 32 PID 1608 wrote to memory of 828 1608 iexplore.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf10eda2ee900cfe8be82509ffd9be21c70fe31f63d7582f9ae433343eb877f6.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:912
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:276
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275461 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:828
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD541b06186817219196dde08bc067291ad
SHA1cf2dbf51ab04eed810adea637e2eb940421948f4
SHA256baded2b7c82a1b992e89a5b24725789b074a10533b1c3aa5a62f12cc20e4befb
SHA5122a0517dc3dc69f9c88a5944b491aedc92d7e6e657dbf89ea01186e85af934848219bfe6cfb49107e349081f916f27bb4841725a85bcca75d3f492168fc6354d5