Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe
Resource
win10v2004-20220812-en
General
-
Target
ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe
-
Size
354KB
-
MD5
1f04108924a073198369170e9ccec248
-
SHA1
bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c
-
SHA256
ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7
-
SHA512
a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851
-
SSDEEP
3072:7ToHR8L1KwK9f7UgV4qJMEG5qzxb251AEwRnEsScv3qug0z:7TEqL1u9TUgV5Rpzxb2nsnXh
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1168 Zihqhp.exe 576 Zihqhp.exe -
Loads dropped DLL 2 IoCs
pid Process 1372 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 1372 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zihqhp = "C:\\Users\\Admin\\AppData\\Roaming\\Zihqhp.exe" ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1080 set thread context of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1168 set thread context of 576 1168 Zihqhp.exe 30 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375812286" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA1EAC71-69B7-11ED-B303-EEAC7132E42C} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1372 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 576 Zihqhp.exe Token: SeDebugPrivilege 692 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1872 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1872 IEXPLORE.EXE 1872 IEXPLORE.EXE 692 IEXPLORE.EXE 692 IEXPLORE.EXE 692 IEXPLORE.EXE 692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1080 wrote to memory of 1372 1080 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 28 PID 1372 wrote to memory of 1168 1372 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 29 PID 1372 wrote to memory of 1168 1372 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 29 PID 1372 wrote to memory of 1168 1372 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 29 PID 1372 wrote to memory of 1168 1372 ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe 29 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 1168 wrote to memory of 576 1168 Zihqhp.exe 30 PID 576 wrote to memory of 1772 576 Zihqhp.exe 31 PID 576 wrote to memory of 1772 576 Zihqhp.exe 31 PID 576 wrote to memory of 1772 576 Zihqhp.exe 31 PID 576 wrote to memory of 1772 576 Zihqhp.exe 31 PID 1772 wrote to memory of 1872 1772 iexplore.exe 32 PID 1772 wrote to memory of 1872 1772 iexplore.exe 32 PID 1772 wrote to memory of 1872 1772 iexplore.exe 32 PID 1772 wrote to memory of 1872 1772 iexplore.exe 32 PID 1872 wrote to memory of 692 1872 IEXPLORE.EXE 34 PID 1872 wrote to memory of 692 1872 IEXPLORE.EXE 34 PID 1872 wrote to memory of 692 1872 IEXPLORE.EXE 34 PID 1872 wrote to memory of 692 1872 IEXPLORE.EXE 34 PID 576 wrote to memory of 692 576 Zihqhp.exe 34 PID 576 wrote to memory of 692 576 Zihqhp.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe"C:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exeC:\Users\Admin\AppData\Local\Temp\ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Roaming\Zihqhp.exe"C:\Users\Admin\AppData\Roaming\Zihqhp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Roaming\Zihqhp.exeC:\Users\Admin\AppData\Roaming\Zihqhp.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:692
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5117f4b58323f51e7acd483c6c92be08f
SHA1aeb28de24f885768cd05fbe93d6476ffae2be8ff
SHA256b41e1c24efee9eba829fb88d07de055e01c452e0d2ce2934d24e4423b833de8e
SHA512aa30a2ffb341d1cf821fde399eb392ae9c5db81634e8587b27d3adc98a3ee29dbdfc236ba9c200cedd2a0bcc7262e52cad9d3711a0abc5b80edbb7207ff7342a
-
Filesize
354KB
MD51f04108924a073198369170e9ccec248
SHA1bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c
SHA256ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7
SHA512a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851
-
Filesize
354KB
MD51f04108924a073198369170e9ccec248
SHA1bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c
SHA256ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7
SHA512a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851
-
Filesize
354KB
MD51f04108924a073198369170e9ccec248
SHA1bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c
SHA256ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7
SHA512a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851
-
Filesize
354KB
MD51f04108924a073198369170e9ccec248
SHA1bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c
SHA256ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7
SHA512a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851
-
Filesize
354KB
MD51f04108924a073198369170e9ccec248
SHA1bb3e5f5f565c7ae0f588ea3e4c40b0ffcf91510c
SHA256ceaf58ec3fe3e00c5de53880b87775843ac5a89d88fa2b6121b500cd97b9e2e7
SHA512a08f36fbfd6ddb8817417c6079fe3e1fdad0272624363b4a3a5f956c595b4398f9f41d802fbd92acb16412418bb732521c1d754f1a608d9ea819798b16e7e851