Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 19:24
Static task
static1
Behavioral task
behavioral1
Sample
214772eef96c87f6e04c9447384a31e5.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
214772eef96c87f6e04c9447384a31e5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
214772eef96c87f6e04c9447384a31e5.exe
-
Size
124KB
-
MD5
214772eef96c87f6e04c9447384a31e5
-
SHA1
a2bf5350b6a36c71d0b9e350e3cea34d285b293a
-
SHA256
200a33f3776fbe48ce1565851d06e6e8e1462f91e88d3326581e1b4327613bce
-
SHA512
4fddcc0509e8060263360515b94a116f908407be0ea7e66abfc4b9a3aab310264aaad0ded68921fa1731242f0975941643f8de521b9877f9c5ab921bf85cf096
-
SSDEEP
3072:q1i/NU8bOMYcYYcmy5cU+gTn6HOjDhWrzvvQwlgOks5YmMOMYcYY51i/NU8F:Ui/NjO5YBgegD0PHzSv3Oai/NN
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} 214772eef96c87f6e04c9447384a31e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe" 214772eef96c87f6e04c9447384a31e5.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 214772eef96c87f6e04c9447384a31e5.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\ie.bat 214772eef96c87f6e04c9447384a31e5.exe File created C:\WINDOWS\SysWOW64\qx.bat 214772eef96c87f6e04c9447384a31e5.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\windows.exe 214772eef96c87f6e04c9447384a31e5.exe File opened for modification C:\WINDOWS\windows.exe 214772eef96c87f6e04c9447384a31e5.exe File opened for modification C:\WINDOWS\windows.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "752255714" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000ffdde745f082c77f7d668a9dbb7ca7de97439a480747bedf33b2832f0293a6e9000000000e8000000002000020000000228aa065cb3b37984ef80b61d98ceaf0a2c341589496b3b648e683907db281a3200000001ba7d47421b91607ca61a387de9198fd8b1550e097e7bfb07605ccba58458545400000009abd968a53a55b0041f760e076a0f9a4e4d6c7f73272d1127ac02bd81431182f7a6f6d037110f222706efc554dd8ee08327732c87f2881e9fcfe5bc35b8bdc2d IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988344" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main 214772eef96c87f6e04c9447384a31e5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4BF489B9-442B-11ED-B696-FE977829BE37} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000272959d06764c9d8b1db5d2249613093ca9740cf8459f43e3ec950f04e3b6cb7000000000e8000000002000020000000627548f08494baf62edb54a6ccb0eae1b9e8cdde8185dbb88923db75282cee8e2000000032fdee1df9edd32e811cfc075bbce42221532a33d340d035dffceae494e5904740000000ad3b64f182bd195757727cce37fd9c6e58f3d3125c3bd29f9698c4deadddc1708e6348cf73410d281e4107fb94ef842e046cd11984d1d6fcef3cbe1fff73f73d IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203ba82538d8d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "752255714" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988344" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c0222d38d8d801 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371683831" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" 214772eef96c87f6e04c9447384a31e5.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe 2988 214772eef96c87f6e04c9447384a31e5.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4720 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2988 214772eef96c87f6e04c9447384a31e5.exe 4720 IEXPLORE.EXE 4720 IEXPLORE.EXE 4428 IEXPLORE.EXE 4428 IEXPLORE.EXE 4428 IEXPLORE.EXE 4428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2988 wrote to memory of 4720 2988 214772eef96c87f6e04c9447384a31e5.exe 82 PID 2988 wrote to memory of 4720 2988 214772eef96c87f6e04c9447384a31e5.exe 82 PID 4720 wrote to memory of 4428 4720 IEXPLORE.EXE 83 PID 4720 wrote to memory of 4428 4720 IEXPLORE.EXE 83 PID 4720 wrote to memory of 4428 4720 IEXPLORE.EXE 83 PID 2988 wrote to memory of 4264 2988 214772eef96c87f6e04c9447384a31e5.exe 84 PID 2988 wrote to memory of 4264 2988 214772eef96c87f6e04c9447384a31e5.exe 84 PID 2988 wrote to memory of 4908 2988 214772eef96c87f6e04c9447384a31e5.exe 85 PID 2988 wrote to memory of 4908 2988 214772eef96c87f6e04c9447384a31e5.exe 85 PID 2988 wrote to memory of 4908 2988 214772eef96c87f6e04c9447384a31e5.exe 85 PID 4908 wrote to memory of 2288 4908 cmd.exe 87 PID 4908 wrote to memory of 2288 4908 cmd.exe 87 PID 4908 wrote to memory of 2288 4908 cmd.exe 87 PID 2988 wrote to memory of 1568 2988 214772eef96c87f6e04c9447384a31e5.exe 88 PID 2988 wrote to memory of 1568 2988 214772eef96c87f6e04c9447384a31e5.exe 88 PID 2988 wrote to memory of 1568 2988 214772eef96c87f6e04c9447384a31e5.exe 88 PID 1568 wrote to memory of 1680 1568 cmd.exe 90 PID 1568 wrote to memory of 1680 1568 cmd.exe 90 PID 1568 wrote to memory of 1680 1568 cmd.exe 90 PID 2988 wrote to memory of 3920 2988 214772eef96c87f6e04c9447384a31e5.exe 91 PID 2988 wrote to memory of 3920 2988 214772eef96c87f6e04c9447384a31e5.exe 91 PID 2988 wrote to memory of 3920 2988 214772eef96c87f6e04c9447384a31e5.exe 91 PID 3920 wrote to memory of 4048 3920 cmd.exe 93 PID 3920 wrote to memory of 4048 3920 cmd.exe 93 PID 3920 wrote to memory of 4048 3920 cmd.exe 93 PID 2988 wrote to memory of 260 2988 214772eef96c87f6e04c9447384a31e5.exe 94 PID 2988 wrote to memory of 260 2988 214772eef96c87f6e04c9447384a31e5.exe 94 PID 2988 wrote to memory of 260 2988 214772eef96c87f6e04c9447384a31e5.exe 94 PID 260 wrote to memory of 3844 260 cmd.exe 96 PID 260 wrote to memory of 3844 260 cmd.exe 96 PID 260 wrote to memory of 3844 260 cmd.exe 96 PID 2988 wrote to memory of 4232 2988 214772eef96c87f6e04c9447384a31e5.exe 97 PID 2988 wrote to memory of 4232 2988 214772eef96c87f6e04c9447384a31e5.exe 97 PID 2988 wrote to memory of 4232 2988 214772eef96c87f6e04c9447384a31e5.exe 97 PID 4232 wrote to memory of 3364 4232 cmd.exe 99 PID 4232 wrote to memory of 3364 4232 cmd.exe 99 PID 4232 wrote to memory of 3364 4232 cmd.exe 99 PID 2988 wrote to memory of 3688 2988 214772eef96c87f6e04c9447384a31e5.exe 100 PID 2988 wrote to memory of 3688 2988 214772eef96c87f6e04c9447384a31e5.exe 100 PID 2988 wrote to memory of 3688 2988 214772eef96c87f6e04c9447384a31e5.exe 100 PID 3688 wrote to memory of 2824 3688 cmd.exe 102 PID 3688 wrote to memory of 2824 3688 cmd.exe 102 PID 3688 wrote to memory of 2824 3688 cmd.exe 102 PID 2988 wrote to memory of 1788 2988 214772eef96c87f6e04c9447384a31e5.exe 103 PID 2988 wrote to memory of 1788 2988 214772eef96c87f6e04c9447384a31e5.exe 103 PID 2988 wrote to memory of 1788 2988 214772eef96c87f6e04c9447384a31e5.exe 103 PID 1788 wrote to memory of 2296 1788 cmd.exe 105 PID 1788 wrote to memory of 2296 1788 cmd.exe 105 PID 1788 wrote to memory of 2296 1788 cmd.exe 105 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 2288 attrib.exe 1680 attrib.exe 4048 attrib.exe 3844 attrib.exe 3364 attrib.exe 2824 attrib.exe 2296 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\214772eef96c87f6e04c9447384a31e5.exe"C:\Users\Admin\AppData\Local\Temp\214772eef96c87f6e04c9447384a31e5.exe"1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.212ok.com/Gbook.asp?qita2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4720 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4428
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan2⤵
- Modifies Internet Explorer settings
PID:4264
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:2288
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- Views/modifies file attributes
PID:4048
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:3844
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:3364
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\windows.exe"3⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\system.exe"3⤵
- Views/modifies file attributes
PID:2296
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5f8fef7780fcf87eba49e8b57ca9ccf47
SHA1ac3b352afe4c2fc5fc47ef3302693a78defde507
SHA256c84052843cd236ef4d0c37fa904f962c4b80c3c9a6b72d8ff9b9e6b73e30919c
SHA5120455d942a50c00dbef9ee8b5ae78d94b827de749c802d081d25ba3cdde4851a3e7ae07a6907fcba13424be256ed85ed7c8ad216dc98317dd0f0da8084e1c56ed
-
Filesize
124KB
MD5ad2a46ec4caf16f205c0c6998cf5edd1
SHA15f3ca08a76020fda7877ebae68208b2aa12d431f
SHA256ef50147b4551e3b86699de8a11385505f45d752cd459fd14324572d854425c59
SHA512472751cd8bf747b3f473d9ae5f7e8e3efcd8c2940a5453c329187128efcdca21f0a8b8518075cfbe378c95bf5d003e5413481641057f617d5f279a5049048f17