Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe
-
Size
143KB
-
MD5
937a045f22268716ddf831261909a0d0
-
SHA1
ea90fdfeec6d86a30f2a402dd69051ff2d91e321
-
SHA256
918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f
-
SHA512
0e69dac5145643a02800c37b7875b7406a9099c95f0da703bbeb69123b6b8b57d2115d46af7529f9c386fa45e3c711f17ded5910774d8c1742054c4a6b90dff5
-
SSDEEP
3072:uVsUDpx0vbcHYMBsWTD8YasmPLjNHiYwjZrtK64Qdnos:uVsJc+WMYSPLjEdjZJn4Q
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Screen Saver Pro 3.1 = "C:\\Users\\Admin\\AppData\\Roaming\\ScreenSaverPro.scr" 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msybyn = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Msybyn.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3548 set thread context of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1720024936" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{91D935DC-58CF-11ED-B696-5A10AEE59B4B} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993628" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1722994353" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993628" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1720024936" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373953379" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993628" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993628" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1722994353" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 952 mspaint.exe 952 mspaint.exe 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 636 IEXPLORE.EXE -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe Token: SeDebugPrivilege 3776 svchost.exe Token: SeDebugPrivilege 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe Token: SeDebugPrivilege 3600 IEXPLORE.EXE Token: SeDebugPrivilege 952 mspaint.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 636 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 952 mspaint.exe 952 mspaint.exe 952 mspaint.exe 952 mspaint.exe 636 IEXPLORE.EXE 636 IEXPLORE.EXE 3600 IEXPLORE.EXE 3600 IEXPLORE.EXE 3600 IEXPLORE.EXE 3600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3548 wrote to memory of 3776 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 3548 wrote to memory of 3776 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 3548 wrote to memory of 3776 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 3548 wrote to memory of 3776 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 3548 wrote to memory of 3776 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 3548 wrote to memory of 3776 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3548 wrote to memory of 1432 3548 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 83 PID 3776 wrote to memory of 952 3776 svchost.exe 84 PID 3776 wrote to memory of 952 3776 svchost.exe 84 PID 3776 wrote to memory of 952 3776 svchost.exe 84 PID 1432 wrote to memory of 1744 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 88 PID 1432 wrote to memory of 1744 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 88 PID 1432 wrote to memory of 1744 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 88 PID 1744 wrote to memory of 636 1744 iexplore.exe 89 PID 1744 wrote to memory of 636 1744 iexplore.exe 89 PID 636 wrote to memory of 3600 636 IEXPLORE.EXE 90 PID 636 wrote to memory of 3600 636 IEXPLORE.EXE 90 PID 636 wrote to memory of 3600 636 IEXPLORE.EXE 90 PID 1432 wrote to memory of 3776 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 1432 wrote to memory of 3776 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 82 PID 1432 wrote to memory of 952 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 84 PID 1432 wrote to memory of 952 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 84 PID 1432 wrote to memory of 3600 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 90 PID 1432 wrote to memory of 3600 1432 918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe"C:\Users\Admin\AppData\Local\Temp\918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:952
-
-
-
C:\Users\Admin\AppData\Local\Temp\918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe"C:\Users\Admin\AppData\Local\Temp\918a8bc0b19c1dd25e62212a96da3424c64260dbe44e317b04724e30e3bcd82f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:636 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3600
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD55ddb1febcd291eb59d3d67d24a05bfd0
SHA1fe957affe27cb991f332e7f5c86d3a15359bd3b9
SHA256ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb
SHA51262d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD58ab21b2328156e593ccca0b8ad50805f
SHA14da1b47999236101a50aac5b62d161b071fe02a6
SHA25691c274ea78a2ebf3ac31f42dacf631011cb8b2b3aa7c689c169bcc8cd43335c0
SHA5122eb0bca6dad9a22bc5815b7e677f5a7799d6da6dc78d8956b41717c0ae103febacf5aaa98041b3d5f9e605b739e19c9e9aa7b2731867f29093f4630de97cbdba