Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 13:09
Behavioral task
behavioral1
Sample
42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
Resource
win10v2004-20220901-en
General
-
Target
42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
-
Size
123KB
-
MD5
a30dbf724ce568b19a8c8ea8dbb8c086
-
SHA1
c6e26604f5eb0bb030bc1c75fcb4ff287aacc2e9
-
SHA256
42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1
-
SHA512
55f06e25cc074e8dbd39ceb50617b89b4afe42d50365de41cd46e8581e91b5f0aea4372e0bd9b3466f1a5eba60a2f51b6bd4aa1f75ec6904e1fdc25669399138
-
SSDEEP
3072:tLQuZUsS7a/G3CYVZ64GsbhFnhE0tRuX22CYJX+MHHVSCqKW:/UNvdVQ4GsbhI0KG23VrHVS6
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1492 mspaint.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xpdldi = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Xpdldi.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\D: mspaint.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1760 set thread context of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18F76711-58D6-11ED-9166-DA7E66F9F45D} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373956184" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe Token: SeDebugPrivilege 1824 svchost.exe Token: SeDebugPrivilege 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe Token: SeDebugPrivilege 1492 mspaint.exe Token: SeDebugPrivilege 1236 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 276 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1492 mspaint.exe 1492 mspaint.exe 1492 mspaint.exe 1492 mspaint.exe 276 IEXPLORE.EXE 276 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1824 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1760 wrote to memory of 1824 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1760 wrote to memory of 1824 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1760 wrote to memory of 1824 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1760 wrote to memory of 1824 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1760 wrote to memory of 1824 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1760 wrote to memory of 1824 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1760 wrote to memory of 1360 1760 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 29 PID 1824 wrote to memory of 1492 1824 svchost.exe 30 PID 1824 wrote to memory of 1492 1824 svchost.exe 30 PID 1824 wrote to memory of 1492 1824 svchost.exe 30 PID 1824 wrote to memory of 1492 1824 svchost.exe 30 PID 1360 wrote to memory of 1396 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 32 PID 1360 wrote to memory of 1396 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 32 PID 1360 wrote to memory of 1396 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 32 PID 1360 wrote to memory of 1396 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 32 PID 1396 wrote to memory of 276 1396 iexplore.exe 33 PID 1396 wrote to memory of 276 1396 iexplore.exe 33 PID 1396 wrote to memory of 276 1396 iexplore.exe 33 PID 1396 wrote to memory of 276 1396 iexplore.exe 33 PID 276 wrote to memory of 1236 276 IEXPLORE.EXE 35 PID 276 wrote to memory of 1236 276 IEXPLORE.EXE 35 PID 276 wrote to memory of 1236 276 IEXPLORE.EXE 35 PID 276 wrote to memory of 1236 276 IEXPLORE.EXE 35 PID 1360 wrote to memory of 1824 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1360 wrote to memory of 1824 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 28 PID 1360 wrote to memory of 1492 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 30 PID 1360 wrote to memory of 1492 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 30 PID 1360 wrote to memory of 1236 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 35 PID 1360 wrote to memory of 1236 1360 42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1492
-
-
-
C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:276 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597B
MD5362641ac609c43b8709822a8bbba4abc
SHA11c22ebfb7cf24d2e03fabf78bb54ac867fe3e692
SHA25631ae49cfcee09d2131a13844ee64553e84a86f84bf95f82ccf9c0c127119d401
SHA512138b833993e9aaa8eed6cd150c31c4f2f4c6b36a6b695cf17fbf7775b44a125e3f9b9cbf66b3e2d469c767ee9a84eb08b2990618df16ddd90f4893bcb4ab9868