Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe
Resource
win10v2004-20220812-en
General
-
Target
774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe
-
Size
581KB
-
MD5
75b0d65a15c3254f03a361fdc53bd75f
-
SHA1
2e1c3e67602fa92a67afd431827b60e0592ab539
-
SHA256
774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c
-
SHA512
9a5a7a570a35f1f232e8b4cc8f9c64bc0747933705c24382117d404374e2e9bc01fa5944d032c88ce15d3f37948547c051759c7d659a5a9518cc59c8a8efceeb
-
SSDEEP
12288:uoMDtCi7NFlZnNqZ9xGrLpZ0ZHEqtgb0U7:ufplNFgxG5eZngb0U
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3644 nbfile0.exe 4004 nbfile1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation nbfile1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000400000001d9f1-141.dat nsis_installer_2 behavioral2/files/0x000400000001d9f1-142.dat nsis_installer_2 -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1763721781" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a1000000000020000000000106600000001000020000000250b8c23a3e4c037837e119cfeee09cdaafd35335831ac4ac149a76c42d399fa000000000e800000000200002000000008fa171f7be73d0edcd720c8d228e2938f6ac1f5c9cbf0d05a53f5bf8b1b50f42000000029ea6d4219e47c30638638f269aaf2c1e0e86af2f32337bf60388a71c15c58a040000000bd88c8f86a7782ab3ecdcceea1a171b8a4aab908f6cb086f15c4219f637797a289197e01705b9eaa95c10a1122569a1dd85e87a5d3b9fef76779956164b56add IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a4e95d5ae5d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a2055c5ae5d801 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991706" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2013564004" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991706" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373127881" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2013564004" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8454E607-514D-11ED-89AC-C264E7FE3618} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1763721781" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991706" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991706" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000975fab978604b14697eb522259e91a10000000000200000000001066000000010000200000002dfddcbd9a67766fe9c5251a4be4be1ea5815ebca3d06b819d07bfcd3956f023000000000e800000000200002000000004e1d665c89d7843500ef59d2b7ff3f21ecd30215b0c2fac95918b791005d9112000000086d1adab432a41487e6394b00a05f4982d897e2259a3ed01ac9f10e991fa592140000000c698f7e86f220ca8eb9d0e82194dbd36d045186c1c5b1c5789efbd7e3b4da183bca901d019af640d4ea95fafdb59464ba4099e89e6d0e93299a7f29e10723c16 IEXPLORE.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings nbfile1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2184 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3644 nbfile0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3644 nbfile0.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 848 wrote to memory of 3644 848 774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe 81 PID 848 wrote to memory of 3644 848 774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe 81 PID 848 wrote to memory of 3644 848 774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe 81 PID 3644 wrote to memory of 2184 3644 nbfile0.exe 82 PID 3644 wrote to memory of 2184 3644 nbfile0.exe 82 PID 2184 wrote to memory of 2392 2184 IEXPLORE.EXE 83 PID 2184 wrote to memory of 2392 2184 IEXPLORE.EXE 83 PID 2184 wrote to memory of 2392 2184 IEXPLORE.EXE 83 PID 3644 wrote to memory of 3724 3644 nbfile0.exe 86 PID 3644 wrote to memory of 3724 3644 nbfile0.exe 86 PID 3644 wrote to memory of 3724 3644 nbfile0.exe 86 PID 848 wrote to memory of 4004 848 774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe 87 PID 848 wrote to memory of 4004 848 774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe 87 PID 848 wrote to memory of 4004 848 774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe 87 PID 4004 wrote to memory of 772 4004 nbfile1.exe 88 PID 4004 wrote to memory of 772 4004 nbfile1.exe 88 PID 4004 wrote to memory of 772 4004 nbfile1.exe 88 PID 4004 wrote to memory of 4468 4004 nbfile1.exe 89 PID 4004 wrote to memory of 4468 4004 nbfile1.exe 89 PID 4004 wrote to memory of 4468 4004 nbfile1.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe"C:\Users\Admin\AppData\Local\Temp\774482bd1e96ab08edfa5d1962e93f2efcc7b816180284121db0e6d4b7f3ed1c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\nbfile0.exeC:\Users\Admin\AppData\Local\Temp\nbfile0.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl33⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\nbfile0.exe3⤵PID:3724
-
-
-
C:\Users\Admin\AppData\Local\Temp\nbfile1.exeC:\Users\Admin\AppData\Local\Temp\nbfile1.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"3⤵PID:772
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\1.vbs"3⤵PID:4468
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize340B
MD5c312bd0bd751a55ae821efc242977f72
SHA1d0e0c5344350434b0cb23dffb082f3be2995324e
SHA256fbc029a2323c92367f7dea9affcee5b44484c47791cff362ed1b10b43dedc2e0
SHA5120fc5bf2944a719a07d50f9cb35d1b66f843d1abfa8ab56514b68d4dc0d23952d7c1c2e3974edfa65efa7577f31e5c7eeae80c7487f826222c60efea141b8d72e
-
Filesize
467KB
MD574869a0346ab36bbba85022612505121
SHA12cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a
SHA2566de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a
SHA512723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5
-
Filesize
467KB
MD574869a0346ab36bbba85022612505121
SHA12cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a
SHA2566de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a
SHA512723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5
-
Filesize
52KB
MD5c4ddf11ebdbf9d8397d710d2cb4e2fab
SHA18008c97e7d6ff92deb3e1755a614f4afedca92b9
SHA25667a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6
SHA5123c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9
-
Filesize
52KB
MD5c4ddf11ebdbf9d8397d710d2cb4e2fab
SHA18008c97e7d6ff92deb3e1755a614f4afedca92b9
SHA25667a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6
SHA5123c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9
-
Filesize
651B
MD54736e7158c27f244482f5a614b9dbdae
SHA1d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9
SHA256b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc
SHA512cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824