Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe
-
Size
1.2MB
-
MD5
a3b9ed42cf228971471a2926717257ef
-
SHA1
1c157acccb3f6d88169788b823190bf57f10b9d3
-
SHA256
e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70
-
SHA512
75b907e17d626a6e05c47b24bcd21f318367e1d4211a5b6aadf1b007d3c84e4a5a86992fda7ca3e25979a7eb3c1f2ee194c62a275bff6b32a1d38ae43bfb0ae1
-
SSDEEP
24576:684Fb6PHUotlxRz0rs2v62W5su0S7sBpbum:6/6PHpMA2v6L0S7sBpKm
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\safe.ico e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\progra~1\ico\meiv.ico expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp expand.exe File opened for modification C:\progra~1\ico\$dpx$.tmp\job.xml expand.exe File created C:\progra~1\ico\$dpx$.tmp\c16ef06b901b0c4991b6fa8882e5b741.tmp expand.exe File opened for modification C:\progra~1\ico\Chat.ico expand.exe File opened for modification C:\progra~1\ico\Film.ico expand.exe File created C:\progra~1\ico\$dpx$.tmp\c8a81a69cf53794bb210c925c7dec442.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\33af123815759a41b0cb7e0e8e1a75c0.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\28002cac90947e48bc9aca8bade3cfea.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\fa8601321c2c3d4192e06ba2c3d0652e.tmp expand.exe File created C:\progra~1\ico\$dpx$.tmp\1efa19c4444a9a488a3318c579463efb.tmp expand.exe File opened for modification C:\progra~1\ico\Taobao.ico expand.exe File opened for modification C:\progra~1\ico\Video.ico expand.exe File opened for modification C:\progra~1\ico\Beauty.ico expand.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006be7f66ea0ee2107572c760c6ce05268e5b696c6021a4a1a214d80c28cdae6b3000000000e8000000002000020000000007bdd110697e6ce9a38ae49ac5de37ac3761ab4a4dcbf86689e9b4ec1fa045490000000cda7178fc4c1f77eaf6d0fd22e62fbf900cca8f36ccfb54b7a779cf953ee06d3176d19ffb168b8f67d39eb73ab3f95160e069c89de3f62205d6a7289a9152689128705db5734c1998fa2b9743aea1f6099e3295e7c13357f1e5cb6442023586dc7ecf269d9a6d09598d40316b940e0886f68f3ba6cb6898656a6e5dfb7351a3878b71893a322063bd0370a227ef38bf140000000636fb061dde34f93ee0a3abed09f719a4da0c98c034b91a78147028941432a50e8439271b23fa5f66fc97663ccbe60261802607b9aec23951a033148b7c4588b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46FF84A1-580C-11ED-B7DD-7E0305A911F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000002488d23197cc36a626eba9eab57da9ee5f8b255b6dff40979d5b0e5c4137cab0000000000e800000000200002000000083907c640d1fa06f62f6791791780cfacddee7c491ce1564ed48eacb1890ea6920000000174eb478a64b6fd7ee4d1c5792e0eaa0c4d2f188e38a44a176ab7c95f6ed1e4040000000c089649076000fcf73a9be38442fec8ddcf1a5cf141aee03f2c28e2fffba62b4aa3be2e91675329d3813a4721ea5c3289258642de575e9ec0c931c654fa08bdd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373869503" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d058ef2519ecd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2044 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 2044 iexplore.exe 2044 iexplore.exe 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1232 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 27 PID 1140 wrote to memory of 1232 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 27 PID 1140 wrote to memory of 1232 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 27 PID 1140 wrote to memory of 1232 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 27 PID 1140 wrote to memory of 1932 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 26 PID 1140 wrote to memory of 1932 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 26 PID 1140 wrote to memory of 1932 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 26 PID 1140 wrote to memory of 1932 1140 e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe 26 PID 1232 wrote to memory of 1220 1232 cmd.exe 29 PID 1232 wrote to memory of 1220 1232 cmd.exe 29 PID 1232 wrote to memory of 1220 1232 cmd.exe 29 PID 1232 wrote to memory of 1220 1232 cmd.exe 29 PID 832 wrote to memory of 2044 832 explorer.exe 32 PID 832 wrote to memory of 2044 832 explorer.exe 32 PID 832 wrote to memory of 2044 832 explorer.exe 32 PID 2044 wrote to memory of 1648 2044 iexplore.exe 33 PID 2044 wrote to memory of 1648 2044 iexplore.exe 33 PID 2044 wrote to memory of 1648 2044 iexplore.exe 33 PID 2044 wrote to memory of 1648 2044 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe"C:\Users\Admin\AppData\Local\Temp\e8920e56f6cb7fdf505366f3a215210013fe5e02403a315be2892ee6cee79c70.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe http://www.v258.net/list/list16.html?mmm2⤵PID:1932
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\qr2Hy.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\ico.cab" -F:*.* "C:\progra~1\ico"3⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1220
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.v258.net/list/list16.html?mmm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2044 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5ada787702460241a372c495dc53dbdcf
SHA1da7d65ec9541fe9ed13b3531f38202f83b0ac96d
SHA2560d0f600f95192d2d602dbda346c4e08745295f331f5a0349deae21705367b850
SHA512c86091735b855691c89c7946145591dec6a6a6a36a2438d392587a9cc1f2d85c1ebe44fcff1cc9d94271a24ebbc2ca38639577a6f5c592e9e10517da26572708
-
Filesize
603B
MD5e6a071fbaacc13b735527a7355c6bb2e
SHA1a9c1d185165261fab267cb5ec15d9021163ed694
SHA256b5a2527993af1b85c8536d53900348e6661b7622a2d6f71a4548b4d68df1b3f9
SHA5126aabb6b2f585f09a077da532712d241e62063e989157b5a13861b29db4456d3f52214d4c8a7c82d30b3825b34454598938f259d24c60ceafef57ec5f882a1ccc
-
Filesize
20KB
MD51319e9998cedc513c68fa6d590b6ad63
SHA1ae95b333e88a13886994f320f5dfb4856168a710
SHA2569a5b18efe243fbe9b9b0be3674a24080e9210436986988f3f85a4007905083bb
SHA512d4052a899c6c310296e2f5fdf6c2031c22d2644be620cb34ddcc6b59789d82a6462daaeb34466c568be48ee975c4a5ab43143eab0792312a6cd0d49f9fbd8d3f