Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2022, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe
Resource
win10v2004-20220812-en
General
-
Target
249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe
-
Size
45KB
-
MD5
696d9a02e0d1000de2852f753c1644ad
-
SHA1
1ff9a64bf8c876b1d2029464f33eda72a59cb26e
-
SHA256
249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3
-
SHA512
8aded539891fe80d264dc3e478a548deffd63ac873034a80038863b1ae2949cfad13321025db5ca48fc53254e32bb5d724fdb3ccbb536d48b0ed34b32fa6ea1f
-
SSDEEP
768:Q6MDEOgk6guQrhO23k7/9sppE0iKFz89519yFSUKhJJ16c5QFeJ0WZOY0Ag+ae71:gExDPQ9l3ky88x8vTJJ16mQ60WZOY0AP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe -
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscrIpt.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\taoY.ico 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe File created C:\Windows\SysWOW64\pop2.vbs 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\StormII\StormLib.nqm 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2630517923" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\95081.net\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\95081.net IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\95081.net\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C4B5992C-4BF6-11ED-89AC-4AA92575F981} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2630833240" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30990339" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.95081.net\ = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990339" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30990339" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.95081.net IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.95081.net\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\95081.net IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\95081.net\Total = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30990339" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2630517923" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2630833240" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372540851" iexplore.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nqm 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.nqm\ = "JSEFile" 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1680 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1680 iexplore.exe 1680 iexplore.exe 640 IEXPLORE.EXE 640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2332 wrote to memory of 3236 2332 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe 82 PID 2332 wrote to memory of 3236 2332 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe 82 PID 2332 wrote to memory of 3236 2332 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe 82 PID 2332 wrote to memory of 5012 2332 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe 83 PID 2332 wrote to memory of 5012 2332 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe 83 PID 2332 wrote to memory of 5012 2332 249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe 83 PID 5012 wrote to memory of 1680 5012 wscrIpt.exe 84 PID 5012 wrote to memory of 1680 5012 wscrIpt.exe 84 PID 1680 wrote to memory of 640 1680 iexplore.exe 85 PID 1680 wrote to memory of 640 1680 iexplore.exe 85 PID 1680 wrote to memory of 640 1680 iexplore.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe"C:\Users\Admin\AppData\Local\Temp\249ee777601bd3b609bc00d0f1dc6ff50e0d7c17cfd24d580dc650bc9b1a73c3.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\wscriPt.exe"C:\Windows\system32\wscriPt.exe" "C:\Program Files (x86)\StormII\StormLib.nqm"2⤵PID:3236
-
-
C:\Windows\SysWOW64\wscrIpt.exe"C:\Windows\system32\wscrIpt.exe" "C:\Windows\system32\pop2.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.95081.net/2.htm3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:640
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5a26d1b1ca0d52edce481f7c40d7c12ba
SHA12b87ac768b4763726bc65d1d88aecb7417358863
SHA256627649fbe706ae75bf63d00b251fba80f95ff87ae1987eb83085044d9453c855
SHA512877d6e128a70af7f0782f3ec7c1d13fdf0813e421b659681534ed8e94f33f4c71ad27d5e02a1e79754a430eeb6dbb252e7758422518697b70ee4bea91d2e9a88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5d4d443a25ea0e792142718c16af91a0f
SHA126548c59a5086269e51679a3dca3e7bd83daea28
SHA256b0f96f3b571b7eff330f0109ab82447af0108562bf3937e530028d429adfd3b5
SHA5127f49020d73b47a57fc14e4e3f2346b4b7595070fded5fbce9768310c8ab32837b3a4621f51d36798059df56317aca3e36ff4bbdffaaebb4dd921be5c9239848a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD533782348de87a0cccfd87ac9199125af
SHA1b5e47aa56429c9bb814bc557a22259a3c8fd2f6c
SHA2566ca973cd08ed6562ae0aadd965a84727403499f4690601f83338e597d6b08297
SHA512e70212432c5a39238aef2a285ba0de1b745822862530998c2dc4b78c31e2086f78b011ba605df2161548232628b04e0e5020fceb809213d72cd2ed0e98ab2e01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD533782348de87a0cccfd87ac9199125af
SHA1b5e47aa56429c9bb814bc557a22259a3c8fd2f6c
SHA2566ca973cd08ed6562ae0aadd965a84727403499f4690601f83338e597d6b08297
SHA512e70212432c5a39238aef2a285ba0de1b745822862530998c2dc4b78c31e2086f78b011ba605df2161548232628b04e0e5020fceb809213d72cd2ed0e98ab2e01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD533782348de87a0cccfd87ac9199125af
SHA1b5e47aa56429c9bb814bc557a22259a3c8fd2f6c
SHA2566ca973cd08ed6562ae0aadd965a84727403499f4690601f83338e597d6b08297
SHA512e70212432c5a39238aef2a285ba0de1b745822862530998c2dc4b78c31e2086f78b011ba605df2161548232628b04e0e5020fceb809213d72cd2ed0e98ab2e01
-
Filesize
216B
MD5d2855e074948c9f561a6098941b7042b
SHA188b524946dc5db7ac956647de59dbb5e8735e8ea
SHA2560de0d449ffae418e267c1d03d9f1d349807ce9a026c265f230cc0bc8fe5f08c6
SHA5122c1269b87584d06c8f61cec6014d308dcd98f672c7c6e467c7063f87130fefad045e0c41cbe1e67fc49767038b8bc29aa60e4856e66b9657a83b6e373df008d0