Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe
Resource
win10v2004-20220812-en
General
-
Target
65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe
-
Size
83KB
-
MD5
935e480b59341a773dfb9b195a166980
-
SHA1
03f8b5ca29c916285080d6f64dd9c1f2beaea17e
-
SHA256
65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14
-
SHA512
f3ef73f3bae4221678550702987cd2e7326a54088a8d3de793f83ed6f927d8b958117cf2c165aa0c50619914b8ae11d794045427daab0ef50c7481c11d3b4e95
-
SSDEEP
1536:ECFLQOVN9o7EHjRpO8WGY8DiY3pAol0SKw:LLQIXpRpzWGVDigAol0SK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD4E7951-58CA-11ED-B243-5AF036119C64} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373951419" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1148 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1148 IEXPLORE.EXE 1148 IEXPLORE.EXE 520 IEXPLORE.EXE 520 IEXPLORE.EXE 520 IEXPLORE.EXE 520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1068 2012 65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe 27 PID 2012 wrote to memory of 1068 2012 65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe 27 PID 2012 wrote to memory of 1068 2012 65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe 27 PID 2012 wrote to memory of 1068 2012 65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe 27 PID 1068 wrote to memory of 1148 1068 iexplore.exe 28 PID 1068 wrote to memory of 1148 1068 iexplore.exe 28 PID 1068 wrote to memory of 1148 1068 iexplore.exe 28 PID 1068 wrote to memory of 1148 1068 iexplore.exe 28 PID 1148 wrote to memory of 520 1148 IEXPLORE.EXE 30 PID 1148 wrote to memory of 520 1148 IEXPLORE.EXE 30 PID 1148 wrote to memory of 520 1148 IEXPLORE.EXE 30 PID 1148 wrote to memory of 520 1148 IEXPLORE.EXE 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe"C:\Users\Admin\AppData\Local\Temp\65b7a971b93982e418cec850d6c27fe327a897716eaa6085d0528f3706a46a14.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:520
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD500b8876d8bc90e02e0abbb5bf23082de
SHA13c83eb23fb8ef5768a84d8a581e6da855ba528a6
SHA25665d03de9b3e5759c67cd637c37ab26d238f9079fc2185d3570e4d60f95a8a229
SHA51282a4fc10553d378ae6cb6faa6ae6c075df74fe8255bf475cb189817b53e35956e471a33cd3245f27bd2379ca15cf9f3e5c9e0189ee839ed062dbedb34f9d685e