Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
Resource
win10v2004-20220901-en
General
-
Target
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
-
Size
200KB
-
MD5
4d3cd27b04757cbee353f2d695aaadd6
-
SHA1
a60669e7cf30bd313af33f2c835851d37f5ba43d
-
SHA256
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
-
SHA512
52744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d
-
SSDEEP
3072:DyzGoDoxz/ch6pSPKAtArmLuAl5aFmCUlK3eDjyF/kPbV1P1oX1l:DySGwz0TBtArmlFhKuDOFcjCl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2008 ¯«²§±©¾¦¾.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe -
Loads dropped DLL 2 IoCs
pid Process 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373023246" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000c5e5563057a80859a4d2588d03df9e6b764e12874956129970e523280bee39f3000000000e8000000002000020000000b6369c273315be34e38a32dfb87ffc2bf9ea318539edcdf8370c3f5c9693cee990000000d749d1883e58731bf968d22cca00ce2cb073c6daa3431845cd32a862d6ccb52f9bc9b8fd04e86a136f6312e1ee6c2e7a155e14ee589544462f796e1be9d9534be902eb17c93e101b9f166c0c5ae57bb2845a9adbdf51802f304f37fb3747f8b0a82427eac1b22fdb7fe8754a3eb26ff50616bf6f92860be5a60700f9614758465e63348d04dccb47177feb4604e2623a40000000f7473e3ea51ad1f611b6bc1f2f759b355688b65831510158dd55667d0a38afc86d6b22f680b5c030ef881732cfc76734def272842d205572bb19241415e322ad iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409dced366e4d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E96A2340-5059-11ED-977F-FAF5FAF3A79A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000c8c3772a370cc51dc2c28ae9ff027cadb10151ebffdf5d71edc3c85c28b5f28e000000000e8000000002000020000000f4f64df78a5eed385ab8b17943689da356d0fb9c6110d695c6219baa759398af20000000c06e4063c8059ed1d00d4d589b689128d801de7deff1563d4c4e5e29a0e029f84000000021a4f61c14b22bd655097918060d99fb08a57344036c1248da6d3d3990cdc77dd00704adadc85ca3b5370feb6181081eba8ec415f4c1b5696cc3c3f1875e3464 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 2008 ¯«²§±©¾¦¾.exe 2028 iexplore.exe 2028 iexplore.exe 1468 IEXPLORE.EXE 1468 IEXPLORE.EXE 1468 IEXPLORE.EXE 1468 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 576 wrote to memory of 2028 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 26 PID 576 wrote to memory of 2028 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 26 PID 576 wrote to memory of 2028 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 26 PID 576 wrote to memory of 2028 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 26 PID 576 wrote to memory of 2008 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 27 PID 576 wrote to memory of 2008 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 27 PID 576 wrote to memory of 2008 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 27 PID 576 wrote to memory of 2008 576 140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe 27 PID 2028 wrote to memory of 1468 2028 iexplore.exe 29 PID 2028 wrote to memory of 1468 2028 iexplore.exe 29 PID 2028 wrote to memory of 1468 2028 iexplore.exe 29 PID 2028 wrote to memory of 1468 2028 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe"C:\Users\Admin\AppData\Local\Temp\140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://goo.gl/5UGSXR2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5069d8d30a5d6cab9dee2f9dbb45bd334
SHA1f3f318e636c030ad4e2f8d12b2a61345d1191da2
SHA25690079043ffa0782e1ee9acb1cae90d1f2c8c7300c9a02aff301900b58bffafbb
SHA5126839231f6fb47b8de8ae7d3dc9878787c14fb8c595e2cafb00a716c0dc973960669d06a3f315f534e5fd1d94e49a5aa4d50859d42b453e7145666f4c77896603
-
Filesize
606B
MD54f65e3f108526e7bf96eed7c2a76f777
SHA18ad6aabb74abdc3deddd79684586ee9ae22056d2
SHA2567e2c3cdc7dfb9569615e13828492e8b8b367e93e8bbc38de54d132c384f0e5d7
SHA512b5608f6c653c69351707c4b084eca2447f9f3ee89dd8bf640b61ad17ea7d8f00c2c2d80c9f4e48d70a360ad3f1fe81685ee2d83ac3c4f4163afa45fb4966934f
-
Filesize
200KB
MD54d3cd27b04757cbee353f2d695aaadd6
SHA1a60669e7cf30bd313af33f2c835851d37f5ba43d
SHA256140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
SHA51252744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d
-
Filesize
200KB
MD54d3cd27b04757cbee353f2d695aaadd6
SHA1a60669e7cf30bd313af33f2c835851d37f5ba43d
SHA256140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
SHA51252744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d
-
Filesize
200KB
MD54d3cd27b04757cbee353f2d695aaadd6
SHA1a60669e7cf30bd313af33f2c835851d37f5ba43d
SHA256140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
SHA51252744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d