Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 08:29 UTC
Static task
static1
Behavioral task
behavioral1
Sample
f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe
Resource
win10v2004-20220812-en
General
-
Target
f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe
-
Size
1.3MB
-
MD5
6c878bd71b08c7275adaa301001a63aa
-
SHA1
1f0b3bf01fa8304c89da1032c38a5bcc39b28660
-
SHA256
f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93
-
SHA512
601b81feda3f5475993d524f8d56e797205a7770a2492d206ef4198b445dbe4cbf1bffa8aba88ef40ec919f024f5455e410fc23c63a97d27eccb062398d13a4a
-
SSDEEP
24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak6:TrKo4ZwCOnYjVmJPaB
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1168 set thread context of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1124 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 1124 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 1124 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 1124 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 1124 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27 PID 1168 wrote to memory of 1124 1168 f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe"C:\Users\Admin\AppData\Local\Temp\f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1124
-
Network
-
DNSwjummxzcb4y0ljqu1.zpti3tyb7h.comf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exeRemote address:8.8.8.8:53Requestwjummxzcb4y0ljqu1.zpti3tyb7h.comIN AResponsewjummxzcb4y0ljqu1.zpti3tyb7h.comIN A178.162.203.211wjummxzcb4y0ljqu1.zpti3tyb7h.comIN A178.162.203.226wjummxzcb4y0ljqu1.zpti3tyb7h.comIN A178.162.217.107wjummxzcb4y0ljqu1.zpti3tyb7h.comIN A5.79.71.205wjummxzcb4y0ljqu1.zpti3tyb7h.comIN A5.79.71.225wjummxzcb4y0ljqu1.zpti3tyb7h.comIN A85.17.31.82wjummxzcb4y0ljqu1.zpti3tyb7h.comIN A85.17.31.122wjummxzcb4y0ljqu1.zpti3tyb7h.comIN A178.162.203.202
-
GEThttp://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exeRemote address:178.162.203.211:80RequestGET /6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: wjummxzcb4y0ljqu1.zpti3tyb7h.com
Connection: Keep-Alive
-
GEThttp://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exeRemote address:178.162.203.211:80RequestGET /6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: wjummxzcb4y0ljqu1.zpti3tyb7h.com
Connection: Keep-Alive
-
GEThttp://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exeRemote address:178.162.203.211:80RequestGET /6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: wjummxzcb4y0ljqu1.zpti3tyb7h.com
Connection: Keep-Alive
-
GEThttp://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exeRemote address:178.162.203.226:80RequestGET /6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 HTTP/1.1
Accept: */*
Proxy-Authorization: Basic
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
Host: wjummxzcb4y0ljqu1.zpti3tyb7h.com
Connection: Keep-Alive
-
POSThttp://wjummxzcb4y0ljqu1.zpti3tyb7h.com/__dmp__/f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exeRemote address:178.162.203.226:80RequestPOST /__dmp__/ HTTP/1.1
User-Agent: dBrowser 1 CallGetResponse:1
Host: wjummxzcb4y0ljqu1.zpti3tyb7h.com
Content-Length: 1307
Cache-Control: no-cache
-
POSThttp://wjummxzcb4y0ljqu1.zpti3tyb7h.com/__dmp__/f9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exeRemote address:178.162.203.226:80RequestPOST /__dmp__/ HTTP/1.1
User-Agent: session
Host: wjummxzcb4y0ljqu1.zpti3tyb7h.com
Content-Length: 3871
Cache-Control: no-cache
-
178.162.203.211:80http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220httpf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe621 B 225 B 5 5
HTTP Request
GET http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 -
178.162.203.211:80http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220httpf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe621 B 225 B 5 5
HTTP Request
GET http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 -
178.162.203.211:80http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220httpf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe621 B 225 B 5 5
HTTP Request
GET http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 -
178.162.203.211:80wjummxzcb4y0ljqu1.zpti3tyb7h.comf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe152 B 3
-
178.162.203.226:80http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220httpf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe621 B 225 B 5 5
HTTP Request
GET http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/6e9f895ee1f6d0ab9e43962e2aa7b628f251b45a167da540b2d0783fc49393a4df53c4242115f0305901fd0541c47b58d762bbc9e6ec40ab59fd7b90eb74808e7d3144591ec98220 -
178.162.203.226:80http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/__dmp__/httpf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe1.7kB 265 B 6 6
HTTP Request
POST http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/__dmp__/ -
178.162.203.226:80http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/__dmp__/httpf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe5.8kB 208 B 8 5
HTTP Request
POST http://wjummxzcb4y0ljqu1.zpti3tyb7h.com/__dmp__/
-
8.8.8.8:53wjummxzcb4y0ljqu1.zpti3tyb7h.comdnsf9b4aff105819f22a4d998f0e353f7e00745cee829ca1974dfb4cf9aae1f4e93.exe78 B 206 B 1 1
DNS Request
wjummxzcb4y0ljqu1.zpti3tyb7h.com
DNS Response
178.162.203.211178.162.203.226178.162.217.1075.79.71.2055.79.71.22585.17.31.8285.17.31.122178.162.203.202