Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 13:15 UTC
Static task
static1
Behavioral task
behavioral1
Sample
4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe
Resource
win10v2004-20220812-en
General
-
Target
4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe
-
Size
179KB
-
MD5
045246283d63b1757196f302232c8900
-
SHA1
b20c27fdfa6d82ca5e5b694bcf98ba15d69c1ead
-
SHA256
4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe
-
SHA512
37fe425afc065334b80636ae533d2e6073b1b31509e092312d4ef59ce184f89969c1279930391fd28fd6d9f1e0c7639834800aee6fb9da94ee457a14256b659f
-
SSDEEP
3072:QWceId2Z+oWP9XEdIJ4/+p6kzATcngTdIY8BkP38mOo6EwBjj:QWcFdtosXEd+4XkOdIvqP38mOoz
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4808 Wjzbzx.exe 3116 Wjzbzx.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wjzbzx = "C:\\Users\\Admin\\AppData\\Roaming\\Wjzbzx.exe" 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1400 set thread context of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 4808 set thread context of 3116 4808 Wjzbzx.exe 85 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995248" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995248" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C1E61A9C-5F23-11ED-AECB-F22D08015D11} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374649256" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2630865003" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2535709675" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995248" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2535709675" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4440 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 4440 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4580 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3116 Wjzbzx.exe Token: SeDebugPrivilege 916 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4580 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4580 IEXPLORE.EXE 4580 IEXPLORE.EXE 448 IEXPLORE.EXE 448 IEXPLORE.EXE 448 IEXPLORE.EXE 448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 1400 wrote to memory of 4440 1400 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 81 PID 4440 wrote to memory of 4808 4440 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 84 PID 4440 wrote to memory of 4808 4440 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 84 PID 4440 wrote to memory of 4808 4440 4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe 84 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 4808 wrote to memory of 3116 4808 Wjzbzx.exe 85 PID 3116 wrote to memory of 916 3116 Wjzbzx.exe 87 PID 3116 wrote to memory of 916 3116 Wjzbzx.exe 87 PID 3116 wrote to memory of 916 3116 Wjzbzx.exe 87 PID 916 wrote to memory of 4580 916 iexplore.exe 88 PID 916 wrote to memory of 4580 916 iexplore.exe 88 PID 3116 wrote to memory of 916 3116 Wjzbzx.exe 87 PID 3116 wrote to memory of 916 3116 Wjzbzx.exe 87 PID 4580 wrote to memory of 448 4580 IEXPLORE.EXE 90 PID 4580 wrote to memory of 448 4580 IEXPLORE.EXE 90 PID 4580 wrote to memory of 448 4580 IEXPLORE.EXE 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe"C:\Users\Admin\AppData\Local\Temp\4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe"C:\Users\Admin\AppData\Local\Temp\4b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Roaming\Wjzbzx.exe"C:\Users\Admin\AppData\Roaming\Wjzbzx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Roaming\Wjzbzx.exe"C:\Users\Admin\AppData\Roaming\Wjzbzx.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4580 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:448
-
-
-
-
-
-
Network
-
Remote address:8.8.8.8:53Requestapi.bing.comIN AResponseapi.bing.comIN CNAMEapi-bing-com.e-0001.e-msedge.netapi-bing-com.e-0001.e-msedge.netIN CNAMEe-0001.e-msedge.nete-0001.e-msedge.netIN A13.107.5.80
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
46 B 40 B 1 1
-
1.2kB 8.1kB 15 14
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD55f49b65bdc1713b58ed97d0e9625a968
SHA184b74e55478c9abb163aa6629e3fd3b91bed4806
SHA256a681ab9abc281fd12a7bd06f56e36a21e8ee28b5294815c5e07b781e324a32f9
SHA5124b502288bef324db8ad33e63c7b6f242ef7954a6fbec3ed012530044c82fee3ad1158febe088bc0deea67ac35646a0a1bd6d961c0f67b11fee584e4f1abd753a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD574f0c8c4643c2e7196bc3f5b7ac3e77c
SHA135f727e574c57cd8c7efcd2eb43f5a29382e226e
SHA25626c87d8eee64b68f1364f0af32600294a5995c6df0b107371f2f14c1599b63bd
SHA51233193b8a64118ec63d73553d21dcfab3275623a46744f6b5337dea14626b7df7ba3baf79444499dfd3ef505f68c8b390d9e1260a000673fb5f26cf03e71ebc48
-
Filesize
179KB
MD5045246283d63b1757196f302232c8900
SHA1b20c27fdfa6d82ca5e5b694bcf98ba15d69c1ead
SHA2564b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe
SHA51237fe425afc065334b80636ae533d2e6073b1b31509e092312d4ef59ce184f89969c1279930391fd28fd6d9f1e0c7639834800aee6fb9da94ee457a14256b659f
-
Filesize
179KB
MD5045246283d63b1757196f302232c8900
SHA1b20c27fdfa6d82ca5e5b694bcf98ba15d69c1ead
SHA2564b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe
SHA51237fe425afc065334b80636ae533d2e6073b1b31509e092312d4ef59ce184f89969c1279930391fd28fd6d9f1e0c7639834800aee6fb9da94ee457a14256b659f
-
Filesize
179KB
MD5045246283d63b1757196f302232c8900
SHA1b20c27fdfa6d82ca5e5b694bcf98ba15d69c1ead
SHA2564b760312acae848719fc96106c9c6437de4df71c7d797d4c7c7821818b50b0fe
SHA51237fe425afc065334b80636ae533d2e6073b1b31509e092312d4ef59ce184f89969c1279930391fd28fd6d9f1e0c7639834800aee6fb9da94ee457a14256b659f