Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe
-
Size
48KB
-
MD5
0cfd7b9daaeeccf65756bd2a5a383bb0
-
SHA1
fbb15fe5852c30f3f2c89cd298d1318aa818290b
-
SHA256
203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79
-
SHA512
daf9423aab383a8fc4fbc7732802c45a00f557b92d6014f9197349e8a57d5001f8a9423380826766d000265c59000a51c41b1ad1896563394b660d6a63e3f61a
-
SSDEEP
768:hMTLFoLgpF2jD6JNDVUG93jMyPIGjAHlC5GtE:h6Z/pk+cGtjP5OsAa
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\_Hazafibb = "C:\\Windows\\system32\\djpziddq.exe" 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\djpziddq.exe 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\coyrnmep.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\yfpjsukj.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\bhjxwzav.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\ctajzegj.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\qknilext.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\yiqwjidy.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\nuohozlf.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\ekoginzi.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\wdnsbgtz.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\micpmvnt.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe File opened for modification C:\Windows\SysWOW64\hwokyzvo.dll 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\winamp 7.0 full_install.exe 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3385719533" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995271" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374659209" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b8f6e147f3d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EDE787B0-5F3A-11ED-AECB-C2DBB15B3A76} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3312749416" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d912000000000020000000000106600000001000020000000e3d8f814cab26201b652cb3c733597fc0efecf077339b4ed52f5a1d516dd2cb7000000000e8000000002000020000000a51efa4cb01995f3096100266c4b9eecfc81c31893b164bf19344b10cc8db7b320000000cf5a4906d37672335fa27937976e40e186e8667f95ae2205b248145666dc1a9a40000000fd43a0d52c4a8da42644fbab096ed56985c0e46bc3aa9a1f881c04fc8b9ab68cd4b5a2e01c0e38a02f5fe55c226a36d905fca779e6707ed49aa2ca647ada2f81 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995271" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995271" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3312749416" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000883ed98174fc174d8e18111dae0d9120000000000200000000001066000000010000200000000b41e3f426b3db7f8c40f461b1d7c05dc2f33dec583fb5d9666563cec3b6fef9000000000e8000000002000020000000c25bf3ad285eabc59aeec3833aca5ba44c80cbb2f262ec397c79f79282bac7ca20000000d5da56269c9f978e7db7d28e6fd75120ff335c778a79ca5c800b2613db63142540000000e2a2630a4fb5423674593370dce1053b3f8cda4bd459732edb3540fbdd72a04b245b20b763eeae429d56b07e87450e40135424292edffe5ea299cd3168a159bd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05b31e347f3d801 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2676 iexplore.exe 2676 iexplore.exe 4624 IEXPLORE.EXE 4624 IEXPLORE.EXE 4624 IEXPLORE.EXE 4624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4584 wrote to memory of 2676 4584 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe 78 PID 4584 wrote to memory of 2676 4584 203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe 78 PID 2676 wrote to memory of 4624 2676 iexplore.exe 79 PID 2676 wrote to memory of 4624 2676 iexplore.exe 79 PID 2676 wrote to memory of 4624 2676 iexplore.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe"C:\Users\Admin\AppData\Local\Temp\203d55a92361ef7d5092e8e2c7b46990c91acdc06f975f3185cd762eefb66a79.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://login.live.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4624
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD52fe642009e570ce45aeba39610492dde
SHA148537aca12a82833f310e3debeca2c8ba6c204d1
SHA256575321485b9c0391dfc6de15755c180344c1785687cc5e757b2339c3dd1e5c44
SHA5128c23e4ba14e63510d16be4a622a4d28bd6967fd3de27bf3cacf749600d762dd536468092283b1143cf31168410c6653198a8bcf2faf9c9b3cf029f7a25061784