Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe
-
Size
309KB
-
MD5
6cbc7e6d153fc19965a2c9baa9a74590
-
SHA1
a73364f246c9dfa1391f7643a487d9918acfce10
-
SHA256
2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd
-
SHA512
408ea4a47aa987ec6fc6954f48105c160567389833aaf313ac94fdc09f4db519c9b0c3c9d03898999ed277ca2d60c980a45363557381b7de02056d6c0cd522c0
-
SSDEEP
6144:n9UfckvcZvGexZBBgiDPxnzNoLyW6y+Mnzi6K0jQRRfhYp6RE05dpg00:9Nkvk+QMYP5AWqziBZJpg00
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\Beauty.ico expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\d43d8200cef9ff41b4d8916d2f63e5f8.tmp expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\19b19d0b4e2a5843a412f0de11e8e6ed.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\5c559845229fe9489f3e720763de9136.tmp expand.exe File opened for modification C:\progra~1\ico\meiv.ico expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File created C:\progra~1\ico\$dpx$.tmp\af8e4c3b36c05d4682aecf1e7052d115.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\a33cd6721cc11646a5dbc74b34a56afa.tmp expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\995f315c0332654aa59a3dd8bb3418d6.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c0000000002000000000010660000000100002000000011f9043830a1e9bc10a10622f5ad85b304d46b16e50c32dd371a3915885f0a20000000000e8000000002000020000000f7dcf671c96c6f0d15fefe095c46c24f6e502874dda4b27f3bb29f5e412002fa2000000048f5661662c693ae60f1b2edf6ceb9de3d23da959c56f13ab1120d0273c87858400000008e3d2f397833142be94689add4d9710977fa0d4a1cfed1a06aef3b22491071a92861bdc2d3ccccb68ae2e736681a2eeee6e20c7a84241e08fccdd23e56a39423 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000c147773a0d322a237a4ccddbfe7dd9d1003c0f89298ced51fb29a5c84d701f27000000000e80000000020000200000001d795123284bb39097585c1eb5b8ecafb8c50b54b12391b85cd6802ed1957c1590000000c491ca480878af0076ecdd73a46575105d5f78af3b32a5b0fc5e5edbec7700697c52c1c54bcaac28071cb9582108ce547fce58a2de87a9212192b9e3a5fdbbd622c37ba3c0e4782bcced688e95e4726aeae4c641e417fe3ec04f7df25f80acd78518fff8b24b991d1873cd2c14e496fe585079f2bb904a7e05d9373934455c3c29106fcaa61d87c965abeacccde58c20400000003b85b072217b13c432bd935f886104a9f4ab091ebf82872709cdf297a39044c59a40b58dbd064782fb6f1eaeba89bbe8f267776243280e8fef5e6a896f1e2c46 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371570391" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A599861-4323-11ED-B531-52E8C5FCC7C7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605d141f30d7d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 280 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 280 iexplore.exe 280 iexplore.exe 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1592 wrote to memory of 2040 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 28 PID 1592 wrote to memory of 2040 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 28 PID 1592 wrote to memory of 2040 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 28 PID 1592 wrote to memory of 2040 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 28 PID 2040 wrote to memory of 2012 2040 cmd.exe 30 PID 2040 wrote to memory of 2012 2040 cmd.exe 30 PID 2040 wrote to memory of 2012 2040 cmd.exe 30 PID 2040 wrote to memory of 2012 2040 cmd.exe 30 PID 1592 wrote to memory of 936 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 27 PID 1592 wrote to memory of 936 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 27 PID 1592 wrote to memory of 936 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 27 PID 1592 wrote to memory of 936 1592 2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe 27 PID 1080 wrote to memory of 280 1080 explorer.exe 33 PID 1080 wrote to memory of 280 1080 explorer.exe 33 PID 1080 wrote to memory of 280 1080 explorer.exe 33 PID 280 wrote to memory of 1652 280 iexplore.exe 34 PID 280 wrote to memory of 1652 280 iexplore.exe 34 PID 280 wrote to memory of 1652 280 iexplore.exe 34 PID 280 wrote to memory of 1652 280 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe"C:\Users\Admin\AppData\Local\Temp\2399bce7611824e5c567f6a1f7b607af48303513ed26a23291a7744f5bc5badd.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:936
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\eeFi1.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2012
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:280 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
593B
MD5d7d7760dc4ffc6f1daab56e90e61d20e
SHA13fa294ee6a994ff23a3425233d9580f5b5e13803
SHA256185e0c4c5941df3dfdac336dcafc002286a8dbf1b48a559923a55fe3a86d708c
SHA5127541611bac497b473f87c44728173eb950f34b1556170c34c48294d7560596c9b1f4456c14c453023bb25cd1c3d29c445cbb5015625e9f9c9597f7f9ca7dbea7
-
Filesize
20KB
MD51319e9998cedc513c68fa6d590b6ad63
SHA1ae95b333e88a13886994f320f5dfb4856168a710
SHA2569a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb
SHA512d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f