Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 08:02
Static task
static1
Behavioral task
behavioral1
Sample
fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe
Resource
win10v2004-20220812-en
General
-
Target
fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe
-
Size
581KB
-
MD5
92f2b7b96499992fbd9d561f9fc0b187
-
SHA1
41b0eada0f99389c07fc372eaf62a496644baa8e
-
SHA256
fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d
-
SHA512
19d805559ee403fa34b15d8343e17a08730c4515554d8578f47d4c6ad2d1ef254b17f7b297c7370553e2a5706329faef5656b42d2ca4826ab77b09a65b0a8422
-
SSDEEP
12288:uoMDtCi7NFlZnNqZ9xGrLpZ0ZHEqtgb0UP:ufplNFgxG5eZngb0k
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1604 nbfile0.exe 4256 nbfile1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation nbfile1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0007000000022f78-141.dat nsis_installer_2 behavioral2/files/0x0007000000022f78-142.dat nsis_installer_2 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993577" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000e3cb9773a84f6871d3473af1666badf7d73d5f9a80ab8bcfdcc6c3cb5fbafd92000000000e80000000020000200000005388d2f0d2a19e693dc799269f14faba9a6d9d2ef2a1e97637af5b5724e56b5e20000000e94ac46dcb169b7b956d86cf2ea1fff16daca10072c3693056111127858a73f340000000b5160e6dc2a36f612919d0a3a271df91e4b75b53e032a588d77a6d30a4ed4dd59ba7c1769419452977abc1f05b55608aad2c42e0f7bf3982292c91777e5108ed IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2354917649" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B261E5D8-589C-11ED-AECB-F22D08015D11} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2019c595a9ecd801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373931538" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2277729054" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993577" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000998e1ca85cfe5270d207736e6566b96e7500f00344dee469a6b1a85cec6df9ab000000000e8000000002000020000000b08836d014433bd6bad6b5b820febe1bf894ff572a63bb658cdc0af5397649d7200000007ea2ed757b2ce9f59d4ccd4c2189ea42dfb7abf8c5019bc2bca75e18fc65003240000000de80d82b9064b55da3e820eb47ee4d980529ccc268a77b2b710146130304b53d280980f1c53d759eb1919bbac56ee1186ead633478e23459daae3bb17c5d2c50 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993577" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e039e495a9ecd801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2277729054" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings nbfile1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 384 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1604 nbfile0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 384 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1604 nbfile0.exe 384 IEXPLORE.EXE 384 IEXPLORE.EXE 4816 IEXPLORE.EXE 4816 IEXPLORE.EXE 4816 IEXPLORE.EXE 4816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4744 wrote to memory of 1604 4744 fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe 81 PID 4744 wrote to memory of 1604 4744 fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe 81 PID 4744 wrote to memory of 1604 4744 fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe 81 PID 1604 wrote to memory of 384 1604 nbfile0.exe 82 PID 1604 wrote to memory of 384 1604 nbfile0.exe 82 PID 384 wrote to memory of 4816 384 IEXPLORE.EXE 83 PID 384 wrote to memory of 4816 384 IEXPLORE.EXE 83 PID 384 wrote to memory of 4816 384 IEXPLORE.EXE 83 PID 1604 wrote to memory of 2304 1604 nbfile0.exe 84 PID 1604 wrote to memory of 2304 1604 nbfile0.exe 84 PID 1604 wrote to memory of 2304 1604 nbfile0.exe 84 PID 4744 wrote to memory of 4256 4744 fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe 85 PID 4744 wrote to memory of 4256 4744 fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe 85 PID 4744 wrote to memory of 4256 4744 fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe 85 PID 4256 wrote to memory of 4008 4256 nbfile1.exe 86 PID 4256 wrote to memory of 4008 4256 nbfile1.exe 86 PID 4256 wrote to memory of 4008 4256 nbfile1.exe 86 PID 4256 wrote to memory of 5076 4256 nbfile1.exe 87 PID 4256 wrote to memory of 5076 4256 nbfile1.exe 87 PID 4256 wrote to memory of 5076 4256 nbfile1.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe"C:\Users\Admin\AppData\Local\Temp\fd754df7fa092e6136a78a9b939f23ddf8d3929976016b3b4098d4aa1ff3257d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\nbfile0.exeC:\Users\Admin\AppData\Local\Temp\nbfile0.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl33⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4816
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\nbfile0.exe3⤵PID:2304
-
-
-
C:\Users\Admin\AppData\Local\Temp\nbfile1.exeC:\Users\Admin\AppData\Local\Temp\nbfile1.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"3⤵PID:4008
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\1.vbs"3⤵PID:5076
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD55ddb1febcd291eb59d3d67d24a05bfd0
SHA1fe957affe27cb991f332e7f5c86d3a15359bd3b9
SHA256ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb
SHA51262d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5272d7286d13a020efed4b3fa2d307135
SHA1a006c96b01c02fea6146e12496da86054749aa33
SHA2564153418ac2d5108a6a09d8b4bcf9808d01d6c3449a1c812b0c9fc85227e92c50
SHA5123ace50c7238018a851008fdbecaf29fe9bc194b5b28ce24bab09dcf9a3cccfef665430394bbdebe0237fbbc22a0547623178ceff6ccab826bb2809795832e656
-
Filesize
467KB
MD574869a0346ab36bbba85022612505121
SHA12cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a
SHA2566de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a
SHA512723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5
-
Filesize
467KB
MD574869a0346ab36bbba85022612505121
SHA12cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a
SHA2566de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a
SHA512723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5
-
Filesize
52KB
MD5c4ddf11ebdbf9d8397d710d2cb4e2fab
SHA18008c97e7d6ff92deb3e1755a614f4afedca92b9
SHA25667a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6
SHA5123c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9
-
Filesize
52KB
MD5c4ddf11ebdbf9d8397d710d2cb4e2fab
SHA18008c97e7d6ff92deb3e1755a614f4afedca92b9
SHA25667a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6
SHA5123c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9
-
Filesize
651B
MD54736e7158c27f244482f5a614b9dbdae
SHA1d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9
SHA256b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc
SHA512cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824