Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe
Resource
win10v2004-20220812-en
General
-
Target
80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe
-
Size
178KB
-
MD5
70d2c5786b535e8f8487236db8526160
-
SHA1
03d13a48f963945378c63bc38865f23617ed6ef6
-
SHA256
80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992
-
SHA512
17f68436e0c800ef6c38a98a5d47959aba7285ed45f5d568f79de5c2e767f2ee845bba852a8f064770df4375ef34b9946ba95749e8f148e395d61a022c8e4cf1
-
SSDEEP
3072:akAwOzhjdRmSZiAqFbrnp+KsYGnggRqM86sUd8cKgev3Tno3LFkZWmv:+w8h/7PCkKsYGggB8mFrC3Lo3Ix
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe -
resource yara_rule behavioral1/memory/536-64-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/536-62-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/768-66-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C44B741-42BA-11ED-AB20-4A12BD72B3C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371525314" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe Token: SeDebugPrivilege 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 768 wrote to memory of 536 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 27 PID 768 wrote to memory of 536 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 27 PID 768 wrote to memory of 536 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 27 PID 768 wrote to memory of 536 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 27 PID 768 wrote to memory of 2008 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 28 PID 768 wrote to memory of 2008 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 28 PID 768 wrote to memory of 2008 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 28 PID 768 wrote to memory of 2008 768 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe 28 PID 536 wrote to memory of 2012 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe 29 PID 536 wrote to memory of 2012 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe 29 PID 536 wrote to memory of 2012 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe 29 PID 536 wrote to memory of 2012 536 80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe 29 PID 2012 wrote to memory of 1292 2012 iexplore.exe 31 PID 2012 wrote to memory of 1292 2012 iexplore.exe 31 PID 2012 wrote to memory of 1292 2012 iexplore.exe 31 PID 2012 wrote to memory of 1292 2012 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe"C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exeC:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:2008
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe
Filesize88KB
MD5a61ea5f2325332c52bff5bce3d161336
SHA13a883b8241f5f2efaa76367240db800d78a0209c
SHA256e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b
SHA512fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5
-
Filesize
597B
MD5f5ae60d17543eea584ac884df5ba6950
SHA18c89a4b3f5db38095f32578d0e11108c233b2a51
SHA2562bcf4e7ad2dbb74a2c236da907e231f505e5937d8ed663718a43c739b491e310
SHA51262b5ab99c1e62b1a821e2814fb7b1f77ce560e50fd5fa99493de2e1c72523c3395a64cbc003a577fec267c3a45c01a7fdaa31c217cb43dfb6cd3777b31560891
-
\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe
Filesize88KB
MD5a61ea5f2325332c52bff5bce3d161336
SHA13a883b8241f5f2efaa76367240db800d78a0209c
SHA256e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b
SHA512fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5
-
\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe
Filesize88KB
MD5a61ea5f2325332c52bff5bce3d161336
SHA13a883b8241f5f2efaa76367240db800d78a0209c
SHA256e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b
SHA512fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5