Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
74s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe
-
Size
1.2MB
-
MD5
117fce8252a4ef54e0c95bc213d7cc50
-
SHA1
73260e29b084116905014928362ab7570764d2bc
-
SHA256
0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9
-
SHA512
ee9c0080dea4d2b537d9cba701f9fb13306484812cd240a54eaca0c6c9befd7ef105823f481aac89cb1efa272b67733af64fa3dcd2b3e12c5420fd7c3a97d0e7
-
SSDEEP
24576:Rvxf9NfXB5klHwHYHD0zNCjllc+TKA5m1lcat0k6z3:RtOH6QjllVH5mcpk6T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe -
resource yara_rule behavioral1/files/0x000c0000000054a8-55.dat upx behavioral1/files/0x000c0000000054a8-56.dat upx behavioral1/files/0x000c0000000054a8-58.dat upx behavioral1/memory/1808-62-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral1/memory/1808-64-0x0000000000400000-0x0000000000454000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1960 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe 1960 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCC4F6A1-6996-11ED-8DB1-7A3897842414} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375798201" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCC51DB1-6996-11ED-8DB1-7A3897842414} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1608 iexplore.exe 1780 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1780 iexplore.exe 1780 iexplore.exe 1608 iexplore.exe 1608 iexplore.exe 932 IEXPLORE.EXE 932 IEXPLORE.EXE 972 IEXPLORE.EXE 972 IEXPLORE.EXE 972 IEXPLORE.EXE 972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1808 1960 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe 28 PID 1960 wrote to memory of 1808 1960 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe 28 PID 1960 wrote to memory of 1808 1960 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe 28 PID 1960 wrote to memory of 1808 1960 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe 28 PID 1808 wrote to memory of 1780 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 29 PID 1808 wrote to memory of 1780 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 29 PID 1808 wrote to memory of 1780 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 29 PID 1808 wrote to memory of 1780 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 29 PID 1808 wrote to memory of 1608 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 30 PID 1808 wrote to memory of 1608 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 30 PID 1808 wrote to memory of 1608 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 30 PID 1808 wrote to memory of 1608 1808 0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe 30 PID 1608 wrote to memory of 972 1608 iexplore.exe 34 PID 1608 wrote to memory of 972 1608 iexplore.exe 34 PID 1608 wrote to memory of 972 1608 iexplore.exe 34 PID 1608 wrote to memory of 972 1608 iexplore.exe 34 PID 1780 wrote to memory of 932 1780 iexplore.exe 33 PID 1780 wrote to memory of 932 1780 iexplore.exe 33 PID 1780 wrote to memory of 932 1780 iexplore.exe 33 PID 1780 wrote to memory of 932 1780 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe"C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exeC:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:932
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:972
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DCC4F6A1-6996-11ED-8DB1-7A3897842414}.dat
Filesize3KB
MD5b2c454b882a1af467a9b10897719a468
SHA1751d07fe28458385db36d95cd9d5a93f9ade833c
SHA256f5ae8527ba030a8ad20b99c85da5076006e818f0606e6d990d938c65a32a2729
SHA512bc09d8fd8bacd844153287ffdfc5be38c00a69d8c229d38c2eff4fe4f727de27879d71ec60900978d57fabcee5c7f3b586bd18d30473d281086308cd101c4f0f
-
C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe
Filesize99KB
MD5f57eee1185dee33198b752dd1f66ad55
SHA1b60f88d65f8805bf2ca095ecd1727b15eed4ff12
SHA2566bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7
SHA512cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40
-
Filesize
604B
MD5046a454dcf313c1d23aa428c2502856f
SHA125b179a92a7d64cd4fc7f90f22cba5ee5dc8b8ea
SHA2568cafbf190d31e94ccbb149b924efc54c756cee6d0e5b03d0b01179937ca84b06
SHA51229f11aeb5f6f9b7defd009d22b2a897edfb19c6f126586129470671583f1840f8ec7866d28f0c4ea87f16990864e8240277b52f8c55c26377ae1862bc751454d
-
\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe
Filesize99KB
MD5f57eee1185dee33198b752dd1f66ad55
SHA1b60f88d65f8805bf2ca095ecd1727b15eed4ff12
SHA2566bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7
SHA512cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40
-
\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe
Filesize99KB
MD5f57eee1185dee33198b752dd1f66ad55
SHA1b60f88d65f8805bf2ca095ecd1727b15eed4ff12
SHA2566bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7
SHA512cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40