Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
226s -
max time network
347s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
3GQQliaotian_veryhuo.com/QQ聊天.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3GQQliaotian_veryhuo.com/QQ聊天.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
3GQQliaotian_veryhuo.com/最火软件站.url
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
3GQQliaotian_veryhuo.com/最火软件站.url
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
3GQQliaotian_veryhuo.com/QQ聊天.exe
-
Size
2.1MB
-
MD5
b551f92843dc3c728373cbd8c7957e00
-
SHA1
682d8872150977331b6eaca37a0871c61cc3c0df
-
SHA256
884f49ceee97fbbdc8d510fb5e3f114b2b3261a81f5117a01bdbd8c929149cb6
-
SHA512
288adee2410202be0deca74675ade7d21892d1517c7a72dda6a26d7b5e95fec29b83226088f238006539bcf957de4f3ec2a0a43a3e896e41e067b1cacb8c8496
-
SSDEEP
49152:LeER8Kozofm4d1T7kxiRGT4r0U+s8KuqGaX0ToIBAUZLYGOT4r0g:HR8KAQ7kxiMT4r0XJBAUZLyT4r0g
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376057523" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08524a4ffffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9865B771-6BF2-11ED-BF38-72F0FB4431DC} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb80000000002000000000010660000000100002000000019f12eca6c9014696912ca4277002d155a5906b4806969f2826f23d2ea0b5e23000000000e8000000002000020000000bdc95bf58f610e39fa7c1315a1a815627d800bf51fcf6b58885a5235657a5de5200000002f0e7175655e7418d5d6d94d36f4f733a8d06f7d3d5af8025eb4145e7cb23cd6400000008a9f6403c8d144aa9d78ddd05f193550814a01bafd166b94904a6bd06a29ac42b1a2a61bef531eb67095f099aa090ff9cca2dc51f9ab280351625309cba971a8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb80000000002000000000010660000000100002000000057f36229e67ad6e46ae54c87b8fff4161777af7518461feb5d001c01a6c82f04000000000e800000000200002000000090fb957bc605ae367a3f47ad9df000dd15c1d49ca58a79dd8445d3b17395b7749000000020d9c03177fc29d7eaf6742510e5c04070fa91957a743de39bb5ae9ca5cd0f9a2ea925f97454bbd7dd42786b5bee3de9d200abed90517173b6a55197db762d066a5e021d91ed31b2558439c5b5c3fc5dc7699e471f3e307800522a59287f721b4de5eb22ff282f14e2ac62bc18102d6b96a6d7a579b00f4a3626dd2f4024169aba000e1deb0bd3858ca50a782d6353134000000046627816f95a4a7eab2988cbf09eeb8bbbfa5a81ec64e693a5a1138c2d05d4bf1f9fb2c70db8492614f59706dfe1ffa339fd72e4eee9366456c5fd4debdca1a1 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 564 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 560 QQ聊天.exe 560 QQ聊天.exe 564 iexplore.exe 564 iexplore.exe 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 560 wrote to memory of 564 560 QQ聊天.exe 28 PID 560 wrote to memory of 564 560 QQ聊天.exe 28 PID 560 wrote to memory of 564 560 QQ聊天.exe 28 PID 560 wrote to memory of 564 560 QQ聊天.exe 28 PID 564 wrote to memory of 1748 564 iexplore.exe 30 PID 564 wrote to memory of 1748 564 iexplore.exe 30 PID 564 wrote to memory of 1748 564 iexplore.exe 30 PID 564 wrote to memory of 1748 564 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3GQQliaotian_veryhuo.com\QQ聊天.exe"C:\Users\Admin\AppData\Local\Temp\3GQQliaotian_veryhuo.com\QQ聊天.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://veryhuo.com/?c2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:564 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD56fced9ca1ea3d4e112dda8438d90018d
SHA188b6c3e21ad7f799f2c5de9b1029b106a999adad
SHA2560e50fd0ad412fe0a4696451933f99d3e8dce77c807c9968d0cfc9dca976e3e19
SHA5125f30a906231cc1f93b496fd6282461e93bcf2a9e7cdf5d81a86f2a9e04a1af64d8827dfb28d6d51a274733cada4c5992dd02531536b297bf61fa12a4b56bf4be