Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe
Resource
win10v2004-20220812-en
General
-
Target
de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe
-
Size
1.1MB
-
MD5
06d47707952f5e8361650ead006d5730
-
SHA1
aff1eb4de82d79a6a8529c3c3922de69c547cc7d
-
SHA256
de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9
-
SHA512
01d9456624d149b6922be4c40cfbc34a7b7c3862c767e55e1d2154ac8059bbff40a3d86cc05d7e113933aba5f375cbca1842f98a951bbb94968aa508f306f79f
-
SSDEEP
24576:68Ww0PWNoTeYYTjvlHDPnr5mQY0OBR60rzr1A:4zONPjv1jnTOB/PZA
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\DefaultValue = "yes" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\UncheckedValue = "no" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "9000" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\CheckedValue = "yes" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\DefaultValue = "yes" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "10" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\CheckedValue = "yes" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\UncheckedValue = "no" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "10" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_IMG\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe = "1" de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe 1980 de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe"C:\Users\Admin\AppData\Local\Temp\de9c540795f94084acf75f8d175a346ab212e9e47ff35e3343f0c370b54d0af9.exe"1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1980