Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 21:26
Static task
static1
Behavioral task
behavioral1
Sample
eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe
Resource
win10v2004-20221111-en
General
-
Target
eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe
-
Size
3.2MB
-
MD5
2acc4cff63991eea9db86c537732dbd6
-
SHA1
81008190bcbbcea323a1ce980f7570822b4346f3
-
SHA256
eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e
-
SHA512
86300599a1426d28e2115ff0cf90f79eb80360d34ec3fdd2b47774515e592290b7904ff780a1a3fd2677ba6ccc08ea7914c97caee99a824f62cca34791b8786b
-
SSDEEP
98304:S45RG0KmFIAG248jUB10g5gxwdg762/lS:LCO48A1x5eph/lS
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1408-4855-0x0000000010000000-0x000000001003F000-memory.dmp upx -
resource yara_rule behavioral1/files/0x000a0000000133af-4859.dat vmprotect behavioral1/files/0x000a0000000133af-4858.dat vmprotect behavioral1/memory/464-4862-0x0000000016080000-0x0000000016152000-memory.dmp vmprotect -
Loads dropped DLL 1 IoCs
pid Process 464 regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\SuperEC_Hook.dll eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2089bc197a03d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000008d9a466c93a3b689a35f2eacc4f73ab50c1b2fd99664e0b2006b9fbb6c6eb6c9000000000e80000000020000200000005a92cc4a2d7f4f31d5cc6a2d87b94ebb11d3d14a11f90f4e8210fe1b9ecf9b4a2000000082ce65cbf1715d1da5c1fbc57915855a75bad546097c31d754efb0466cd00b1a40000000970059917decd57ca70b70ee80cf90362ca372fbc5a9bc0b92c0b2b2792c4da76676c7e6b19b54682e89fd7c56cf498d217edd99bf630e034a3c0d15748dd06a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32B255E1-6F6D-11ED-96D2-EEBA1A0FFCD1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000042171cd8a6cf1a01bf540a8df70af270f9c430a70857f138c3c69f60a48803d9000000000e8000000002000020000000c4fc9dd527fcb728342b801dbd122b9d5faf28e8bd99cd701c5e207952565348900000001a19809d1d18f4e29125ab323515080244650effcdd620ff206c2ad0afc8e3ba2016863a117c8281ec4a5927e63e771ad992993f5419113c354e6c521702d32e54657b5a917411fc04d41f1c522c64dff816a96bbe6576fd217dcc14002b91d07f1de8a15b9448ea96a2cecb0bd90fc4b391fd040776ed24a93d14cd79ce5160a86635689b0599994a6dbf2b5303d909400000004e5dd33fc9c3e98870d28e349797934379e2156fc9d15578c6653606bdbaf8a4cc16ea9155ca1969c9fcc4266280f9340c3b968c03122b3cb78511060b95ac54 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376440022" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 576 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 576 AUDIODG.EXE Token: 33 576 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 576 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 608 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 608 iexplore.exe 608 iexplore.exe 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE 900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1408 wrote to memory of 608 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 31 PID 1408 wrote to memory of 608 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 31 PID 1408 wrote to memory of 608 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 31 PID 1408 wrote to memory of 608 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 31 PID 1408 wrote to memory of 464 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 32 PID 1408 wrote to memory of 464 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 32 PID 1408 wrote to memory of 464 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 32 PID 1408 wrote to memory of 464 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 32 PID 1408 wrote to memory of 464 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 32 PID 1408 wrote to memory of 464 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 32 PID 1408 wrote to memory of 464 1408 eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe 32 PID 608 wrote to memory of 900 608 iexplore.exe 33 PID 608 wrote to memory of 900 608 iexplore.exe 33 PID 608 wrote to memory of 900 608 iexplore.exe 33 PID 608 wrote to memory of 900 608 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe"C:\Users\Admin\AppData\Local\Temp\eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.cnlna.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:608 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:900
-
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s C:\Windows\system32\SuperEC_Hook.dll2⤵
- Loads dropped DLL
PID:464
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5701⤵
- Suspicious use of AdjustPrivilegeToken
PID:576
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\BWAU54W9.htm
Filesize427B
MD5774d13bb0fecd8fd1b141abc974c2840
SHA1683c8cfb5b5d2fdaf704d9fd8c11885a024e0ee4
SHA2564a89eebe118988c98ea41bc4540c8972a2e35ff2a616b933178dce75415191b8
SHA5120759bc9280458afcba4d8a86fb179c98a34f985049d50b4a14c4949d7c99a5c689474a77c9f3564e2ae06a891d53319bf82626ff60cd858e4dda6b93d16e5792
-
Filesize
601B
MD59d1c1df8e8e5cf52ff20e8fcfb7fee21
SHA19668b760c4999e91c4a3b283ce95e130d1794bf5
SHA256b5eac05ca3bfcb3af5baf1e6a3ecf6bb9d8d9fcb1504e97842897b683e5183ab
SHA5125fa4b9a8361221c5f7c716a24a8d16d8a5084bcedda9ec61ba05a9935b1f0bc2ce7ffbbc57fdfe085885a2b5720005bc6fbbd777da642ba6b065a385bbe32165
-
Filesize
368KB
MD56446f02463634295797ff698eb7eb92e
SHA164a20417acf7c9bd67efc601236c85fa640426a8
SHA25653022e175ff09af40a8569a641a261ed08dabc7331afbdde97f2f3d6f9321b33
SHA512eeeb4152b92f9c4cad35d596f6fdec8d4e26b93c1a71627007ce5e490c46bd7773cc65309645ace429467b335fea5fe33cb5aac4cf507367cd9ad72a1b9efbfe
-
Filesize
368KB
MD56446f02463634295797ff698eb7eb92e
SHA164a20417acf7c9bd67efc601236c85fa640426a8
SHA25653022e175ff09af40a8569a641a261ed08dabc7331afbdde97f2f3d6f9321b33
SHA512eeeb4152b92f9c4cad35d596f6fdec8d4e26b93c1a71627007ce5e490c46bd7773cc65309645ace429467b335fea5fe33cb5aac4cf507367cd9ad72a1b9efbfe