Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe
Resource
win10v2004-20220812-en
General
-
Target
15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe
-
Size
115KB
-
MD5
0f76cf7b3e144048f566941346c75e92
-
SHA1
1c6a5e27fee8e7097861ad3badcf04fdf43c5b4c
-
SHA256
15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd
-
SHA512
63d5810622ff301593bf02a0e7660ad598996b4a5fb2808a995e56e9972d803383edafcde002ea0e0339423957768572a0f2d1ecf1ba5e807d32e7a1dc8b3011
-
SSDEEP
3072:MfVp/jp0hYkB+y5z83cRJbAERDaJVsPrFgVUfIqVkS:MtpEYW+y632JkEMsqeIqV
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Screen Saver Pro 3.1 = "C:\\Users\\Admin\\AppData\\Roaming\\ScreenSaverPro.scr" 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pttett = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pttett.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1612 set thread context of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74ED0F21-5F2F-11ED-8B83-6A6CB2F85B9F} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374654281" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe Token: SeDebugPrivilege 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe Token: SeDebugPrivilege 1920 mspaint.exe Token: SeDebugPrivilege 1952 svchost.exe Token: SeDebugPrivilege 2016 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1212 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1920 mspaint.exe 1920 mspaint.exe 1920 mspaint.exe 1920 mspaint.exe 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1952 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1612 wrote to memory of 1952 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1612 wrote to memory of 1952 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1612 wrote to memory of 1952 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1612 wrote to memory of 1952 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1612 wrote to memory of 1952 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1612 wrote to memory of 1952 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1612 wrote to memory of 1860 1612 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 27 PID 1952 wrote to memory of 1920 1952 svchost.exe 28 PID 1952 wrote to memory of 1920 1952 svchost.exe 28 PID 1952 wrote to memory of 1920 1952 svchost.exe 28 PID 1952 wrote to memory of 1920 1952 svchost.exe 28 PID 1860 wrote to memory of 1640 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 31 PID 1860 wrote to memory of 1640 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 31 PID 1860 wrote to memory of 1640 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 31 PID 1860 wrote to memory of 1640 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 31 PID 1640 wrote to memory of 1212 1640 iexplore.exe 32 PID 1640 wrote to memory of 1212 1640 iexplore.exe 32 PID 1640 wrote to memory of 1212 1640 iexplore.exe 32 PID 1640 wrote to memory of 1212 1640 iexplore.exe 32 PID 1212 wrote to memory of 2016 1212 IEXPLORE.EXE 34 PID 1212 wrote to memory of 2016 1212 IEXPLORE.EXE 34 PID 1212 wrote to memory of 2016 1212 IEXPLORE.EXE 34 PID 1212 wrote to memory of 2016 1212 IEXPLORE.EXE 34 PID 1860 wrote to memory of 1612 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 25 PID 1860 wrote to memory of 1612 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 25 PID 1860 wrote to memory of 1952 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1860 wrote to memory of 1952 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 26 PID 1860 wrote to memory of 1920 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 28 PID 1860 wrote to memory of 1920 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 28 PID 1860 wrote to memory of 2016 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 34 PID 1860 wrote to memory of 2016 1860 15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1920
-
-
-
C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"C:\Users\Admin\AppData\Local\Temp\15e7be218dfd4994b88b654b9d264fce077f6fa423482ca0c5199ea29ed1c5cd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
537B
MD5b1a9816c0b45d2ab62e8aa8e0a74fdb8
SHA180e0ac4befa3cf5db82b6958f3754579a0d45133
SHA256e5899bf3aa1cdc43dd67e14b5ac1cbfff42a0d8ed6fc27ae5ff438add3903bc7
SHA512cbdc37adcb006e29d2c34f2044fe50063b757c9110ebbdb188f8dc0f8a2601024f7dd00d39d519813fabd283c02cd0635c4220eca3ac100c5f0db20bc850c833