Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/10/2022, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe
-
Size
24KB
-
MD5
551b14c92726248a9181b39b0052fe20
-
SHA1
df8797ab399a5f951940e01e951e405d8bce3878
-
SHA256
b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7
-
SHA512
021a9548923ed6897daffdb80c483a9c9cead67b7c4fd82dfe16c9243497df41f11b5ae78e4e2e78bc611649b3211ab436e6f544986255147a5033eeb5046519
-
SSDEEP
192:NMwcvY7gE9Juk0/f9UGdcjCjI/kKteDK0sQJEGO:SwwEJ9JukKfyBmkHeDK0sQ2GO
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4041790441e5d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21A1A3C1-5134-11ED-84F9-5A21EB137514} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000077823eba00bfc965fe3d562a58e76b598ca5ab88844c79e08997bc74f05b36b000000000e8000000002000020000000250a93547ecf934712f525fa78948569106d9e1a46a9663b3aff58700e8745b020000000147fa62e829d50599a4d838e07c83158c645668c6b7cbc0f2f7ca06eedf4dce440000000d477b0a2e811532d83d4ba4532d92e85fc1e7e4fc5d914db107d8f3e9cb10a432bfa63b73ab900a9514e97a10c884029d8096d46ff79c324c5a611fd4c560f3d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21A1CAD1-5134-11ED-84F9-5A21EB137514} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000eb6427a1991093f8c6f71aeed32047405603f06d54cb8f6b89809254b7424a9a000000000e8000000002000020000000d38cc950a0fa652436be8f02cc20b57ae7ec74bb58b45b443420d3c9c701b80d9000000035e527c4e3c4ad41e0c2e8e16fefa70e1ecac23f33ce85585440d7eb14590d1948c0abb5df4298db99aa38a368872ad87bbefd0f6d948aa8214208b795e8b4d667b14be4eeb79aec7309ef0e5a06afb05192315ad8efde9abab2b806fd2debb2fb5690e7bab641ce08dfca1207c044b9e6bd0f400c11ce562b9ef1a60dc7cbb0647bd7f244d82bec907817dd38adec30400000003a8a0513482c0bdbb5c9a1323762507c8145854d451d183e5c98179f1367ecace96f81ee9413ae06954fff56e7c8e8bb2f8feaa40199cfcba3886fb6395b22b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373116972" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 572 iexplore.exe 1288 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 572 iexplore.exe 572 iexplore.exe 1288 iexplore.exe 1288 iexplore.exe 1872 IEXPLORE.EXE 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE 1872 IEXPLORE.EXE 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 944 wrote to memory of 2004 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 27 PID 944 wrote to memory of 2004 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 27 PID 944 wrote to memory of 2004 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 27 PID 944 wrote to memory of 2004 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 27 PID 944 wrote to memory of 936 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 28 PID 944 wrote to memory of 936 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 28 PID 944 wrote to memory of 936 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 28 PID 944 wrote to memory of 936 944 b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe 28 PID 1668 wrote to memory of 1288 1668 explorer.exe 31 PID 1668 wrote to memory of 1288 1668 explorer.exe 31 PID 1668 wrote to memory of 1288 1668 explorer.exe 31 PID 1232 wrote to memory of 572 1232 explorer.exe 32 PID 1232 wrote to memory of 572 1232 explorer.exe 32 PID 1232 wrote to memory of 572 1232 explorer.exe 32 PID 572 wrote to memory of 1856 572 iexplore.exe 34 PID 572 wrote to memory of 1856 572 iexplore.exe 34 PID 572 wrote to memory of 1856 572 iexplore.exe 34 PID 572 wrote to memory of 1856 572 iexplore.exe 34 PID 1288 wrote to memory of 1872 1288 iexplore.exe 35 PID 1288 wrote to memory of 1872 1288 iexplore.exe 35 PID 1288 wrote to memory of 1872 1288 iexplore.exe 35 PID 1288 wrote to memory of 1872 1288 iexplore.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe"C:\Users\Admin\AppData\Local\Temp\b11035014114ce143da5e317291468c7f536c64da6f48a3b2cab96ba933519d7.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe "http://www.netgy.com/cpm/10102/10194.jsp?s=11054&dm=2"2⤵PID:2004
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe "http://u.772268.com/gg/1026.html"2⤵PID:936
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.netgy.com/cpm/10102/10194.jsp?s=11054&dm=22⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://u.772268.com/gg/1026.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:572 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{21A1A3C1-5134-11ED-84F9-5A21EB137514}.dat
Filesize3KB
MD5fa36be1dc35cf95e5186c391a9ca87aa
SHA16e1a7817ee69575b4ccd0d8af73085fdf4c64ba7
SHA2564bbb50d6322534292ab796d625ffe89c1e3fbdd2e7798018824c055b4354a6b3
SHA5122865c73a6e04b2ec754d3fc4c84c518a57ef70b35c1b81792ece1b0053d9836678223af6316b772c03d98dca56c2ab04fd1fd52588f77550df25f75f71528269
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{21A1CAD1-5134-11ED-84F9-5A21EB137514}.dat
Filesize4KB
MD54bc4f49d74d2ed4458eacffde3025f61
SHA13e6e9742fa71dd3d13809f6b3baade3af2bfeeb2
SHA25631706bf887713eac716b97a4b1c7e2a13f7459119fbdc69c90c2a8569f8bdc2a
SHA5128c495692a480a0c0f2f80c58e3662a6746c61125d19ba6db197ee835f72109de939fd81ae398dd3612bf057b417beeb16cb2e636b272e5c0ec32d94e14bca5a9
-
Filesize
601B
MD58147d306029f148d04b7b5338a3e7a7c
SHA1feab0775df286db5e75e6fefc7a72b0a39af1932
SHA2566829a40e3cea634fe0b67ff7e3b8b18412823176093b0a1f0ede2a61f186246c
SHA5123a90f50813d9ec235c0d98dab81c52ad0f32418f128458ab58fd0e12295abd268ea8478d301ae6b077cf5b4c79f9cbf982f7540e90418d4dc5d9d5743a63f387