Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
74s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 00:09
Static task
static1
Behavioral task
behavioral1
Sample
6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe
Resource
win10v2004-20220901-en
General
-
Target
6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe
-
Size
179KB
-
MD5
77f21ab212c513d9f6209c50ecc17d90
-
SHA1
0a2e6120143a2a65ea1657ae5a73154214190f32
-
SHA256
6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b
-
SHA512
f1cd4dd47789d838a1d31ca86faa136023b38feb3507ba2c789c68e58381a5f0fac4460fe2db1dd5396d22d7e7382c82990045da95dfc7eab0b0546d0737aa7e
-
SSDEEP
3072:akAwOzhjdRmSZiAqFbrnp+KsYGngDrSsi5LNURwM/0j4IJqmxOilu+jGvCsfe4mf:+w8h/7PCkKsYGgDrS1L2wDMIgmxBuKM6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe -
resource yara_rule behavioral1/memory/1044-60-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1044-63-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1428-66-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B792C21-490A-11ED-B25A-FE72C9E2D9C9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372219310" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B777E71-490A-11ED-B25A-FE72C9E2D9C9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe Token: SeDebugPrivilege 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1840 iexplore.exe 2040 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1840 iexplore.exe 1840 iexplore.exe 2040 iexplore.exe 2040 iexplore.exe 1160 IEXPLORE.EXE 1012 IEXPLORE.EXE 1160 IEXPLORE.EXE 1012 IEXPLORE.EXE 1160 IEXPLORE.EXE 1160 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1428 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 27 PID 1044 wrote to memory of 1428 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 27 PID 1044 wrote to memory of 1428 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 27 PID 1044 wrote to memory of 1428 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 27 PID 1428 wrote to memory of 2040 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 28 PID 1428 wrote to memory of 2040 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 28 PID 1428 wrote to memory of 2040 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 28 PID 1428 wrote to memory of 2040 1428 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe 28 PID 1044 wrote to memory of 1840 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 29 PID 1044 wrote to memory of 1840 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 29 PID 1044 wrote to memory of 1840 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 29 PID 1044 wrote to memory of 1840 1044 6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe 29 PID 1840 wrote to memory of 1160 1840 iexplore.exe 32 PID 1840 wrote to memory of 1160 1840 iexplore.exe 32 PID 1840 wrote to memory of 1160 1840 iexplore.exe 32 PID 1840 wrote to memory of 1160 1840 iexplore.exe 32 PID 2040 wrote to memory of 1012 2040 iexplore.exe 31 PID 2040 wrote to memory of 1012 2040 iexplore.exe 31 PID 2040 wrote to memory of 1012 2040 iexplore.exe 31 PID 2040 wrote to memory of 1012 2040 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe"C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exeC:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1160
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B777E71-490A-11ED-B25A-FE72C9E2D9C9}.dat
Filesize3KB
MD5f14cd19368435f3843ea1e4cd4e29688
SHA144fdfc098efa148a126e7c0fb661d5e8a18d884c
SHA2561e68b06ce6596dbff356494ddc27486b92724ffc7721d073c2843284e838afd1
SHA512ad540341e7d4a9592b238bb4375526c8d624119bfdd583bf02f408fe694dd0cecd99b49249b1c663a36d91f4704a61e3ce25e2876f7b7c7c823300e5e037043c
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B792C21-490A-11ED-B25A-FE72C9E2D9C9}.dat
Filesize3KB
MD5ef7110273a00254693b558f9d628226e
SHA1b57c91c9d3e98a3476318856552da10c96b5ff7b
SHA256b85e596df97ff390b0e9b78169ab8ae10705b4530ce572a06eff8b16e59903a0
SHA51283c7af91873088f21689a0d7d1f34629d8d1787bb7e41c5148a2823cc5919ec2a4a348d0efc47c1eee7c16597a9a9ae2b6b6ad37a2728aa6c8ab7cf245afb46e
-
C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe
Filesize88KB
MD5a61ea5f2325332c52bff5bce3d161336
SHA13a883b8241f5f2efaa76367240db800d78a0209c
SHA256e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b
SHA512fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5
-
Filesize
603B
MD55c4d0afa591636d23d877ed42e51b973
SHA1b92ab0ba3a742128c07a18643c023290be98e752
SHA2568b9eda7da76ba519786eeab2e71b03517ebc0b2e61a5435ece3699a421241853
SHA5125ed33283724f6c1e15c4160252a9d136fdbbd3c17190cea8d8445b1faafd9aca4486d02b21ff14cebfae5ee381a4273800e4544a76a2ee5473b157051e5f4461
-
\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe
Filesize88KB
MD5a61ea5f2325332c52bff5bce3d161336
SHA13a883b8241f5f2efaa76367240db800d78a0209c
SHA256e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b
SHA512fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5
-
\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe
Filesize88KB
MD5a61ea5f2325332c52bff5bce3d161336
SHA13a883b8241f5f2efaa76367240db800d78a0209c
SHA256e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b
SHA512fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5