Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe
Resource
win10v2004-20221111-en
General
-
Target
e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe
-
Size
110KB
-
MD5
1b80b4ad493be6b717e5bacb9f1a7502
-
SHA1
41b2582bd2c4d730938a5f5b9ff12a20ffd08320
-
SHA256
e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690
-
SHA512
4a84e92c7fa41f59d2c8be32a16f0110d8c823dc0cc3fd2824ea67f8543b3acf943947922342b5c99d14f4ca11fcf1de033bc84d30fb16a90f07d34f61cba331
-
SSDEEP
1536:WdSsBR1aUeveIMwQaCkqXkbsJPJcwA5F+hOcIxK:WX3aUqhiksJPJvA5F+hOcIxK
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376452529" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803799439703d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ac7d8e56cea2649a5226d0e41623fda00000000020000000000106600000001000020000000ab45e1506b626f7b30dc9f262a60bdeed14646960f6de2be62cf151cd3163eca000000000e800000000200002000000003fa7c4b50784ac478e02dc54caaa3e91630016b828e0c8315c23217786eae7890000000fbc2e5395a5a3b56663e8207ec5fb75b49ae662d89469a6cf4af9c7f56b2355c8d2cff6e1b3c30815ad94fbd37f53d36dc4ad66020e3ef7722a075515fe1c5298fcb51d6ff5255be0dccdaa6827da5bffcf1a9ed8629956b2a47744950927f6873f841545029567f4fbadc1461d9d92dd9fad5aff83cdafd696cc552babe40b89e60a80cdf3b5ad97b095fa08a053f96400000001da30d47d09b70089634fe7f80f337c717b766341f859e38ab2394b6e98569a9701689a119046b53e23f0b3fa3f856fc22b5a7a39c9aa0b89d39c11d27b295c7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A3FBD11-6F8A-11ED-A50E-C6457FCBF3CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ac7d8e56cea2649a5226d0e41623fda00000000020000000000106600000001000020000000503208e021e9e865e756c8b3187917d2c8e754456c8494ab17ef77e1f3e78ce5000000000e800000000200002000000077aeb90aed5a101ce9db9ce1cd8bd0d519cd444efde4eab8287ada4e52f6ad7820000000bbf607acafc7ce2f850f9858652eb3ac09ba2ca8f041736378bcef98187c3d8f4000000013a83f11363dc1a1949e25127aa4cd80d484d67b7d2fd2ac25c6ad3a5f4be95978d8a670e98cf655b8bf25a44fd9df91ab217ef38e624284fe9edf237d2d54a4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1536 e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe 1776 iexplore.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1536 e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1776 iexplore.exe 1776 iexplore.exe 836 IEXPLORE.EXE 836 IEXPLORE.EXE 836 IEXPLORE.EXE 836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1536 wrote to memory of 1672 1536 e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe 30 PID 1536 wrote to memory of 1672 1536 e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe 30 PID 1536 wrote to memory of 1672 1536 e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe 30 PID 1536 wrote to memory of 1672 1536 e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe 30 PID 1672 wrote to memory of 1776 1672 cmd.exe 32 PID 1672 wrote to memory of 1776 1672 cmd.exe 32 PID 1672 wrote to memory of 1776 1672 cmd.exe 32 PID 1672 wrote to memory of 1776 1672 cmd.exe 32 PID 1776 wrote to memory of 836 1776 iexplore.exe 33 PID 1776 wrote to memory of 836 1776 iexplore.exe 33 PID 1776 wrote to memory of 836 1776 iexplore.exe 33 PID 1776 wrote to memory of 836 1776 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe"C:\Users\Admin\AppData\Local\Temp\e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=4300107^&rsn=plde^&details=^|v6.1.7601x64sp1.0ws^|tt36^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://securedfileinfo.com/404.jsp?chid=4300107&rsn=plde&details=|v6.1.7601x64sp1.0ws|tt36|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p13⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:836
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD51449add840e9160cae5f5b565c634b70
SHA1dc889a8567e97e99d8b3186975f6b969de5aad6c
SHA256ab53d0cb3f95f86c66a7e43185e7abce5c80b18270ebe804cfd73a7249174d36
SHA512192c3eee32ad50022f2f561f4e08c03bfacd7a891e7709e5528ff2641d02a84deafdfd9deb0d086c02b4bedcf8ebf802746f1814a3b8f70afd309695181f4d83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize472B
MD5a0fe20d41a043db700a84924cd9793f3
SHA1c0da481fef6cd00558f6e68b074acb34bef8292f
SHA25603caeb65ab9e22f6d6fe0d344d327950d20ee9ed144e2da0e5e062943a03fc56
SHA512f9de5b16bd1312dcab9ae06c0a39a295a79354821552b39ee48bb456b42b7302d27e9d063243d3766cd0c2bc47255dee21eee7036b99e1c4df02f1c335e204e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5079d0d5c3e97b5a2f7cb16acdc179c59
SHA1d6f9283c8db446a716599319aa13d80ab1b12fbd
SHA256e0c9840acddaa1b238e0984de93648b6e67bdfe715dd0d3e6727f0538814fe31
SHA5123e3bc1f3b038d3740ed2b94724ceb1dc77c1d00d494cf864a3ae9dd323d7079c565ba3c708f9c6a614f19a2a3b0ab2bae13b1b8456d60f846c9b594287b9ca65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize402B
MD59d8be0b107ecefca012a4c21513dec30
SHA11b7cf440a007b28b08f9ac17175ab5675d77e70c
SHA256eecdd4c6835b56221a3c859999428646ddab099417679d2ec58f8e0f476d2778
SHA51255e1ffd3eaf8e177ecad0824e6282bed0ebd70cedbba16d1c956e936f116202b3e358b31df9ac5a9b94069ba5d838620a1882d7aa8f75c54940aab3a8b0c3f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD58bb000d67c50a59bf4a74dc56baf782d
SHA1047dad4e87e4be98d0cfdd91b04f540496153d86
SHA256ba67081c5306f3ce951082eea063051155efd739aee9184affd2ac39a26f2f8e
SHA512db51f2c3698c0149394b91ee95890f01582fda8e1eb5bde9a17bba6aa339c6fd71110f02a17e3c261db6e2cb5dcdef375b119cbb616add4da2387b986254fca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5bcf09ce7980b11f93ae41264c3aebeb8
SHA145001fb9a394ee61e798fc2a64aa90448d669893
SHA2568340536410b755c547a1453c585645afe903ff500701a5e1b0cecaa6d7b55ecb
SHA512b5bbd3dcee224233a11eb8e043de707a6db92cbc761cf71640461ba66fab880e91e9fa3f8579c6a71d833df5b106a8d4c1285ca34a7ab062fa2dd8c44a9fa445
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD572942969100d8c26a131435d18019e4e
SHA1d73e9080913d8e8d523030a498fca36065b1c1f4
SHA256fa3f0e4df6abba4a5c901f8db6065601db1408f3e8c6c4fd02f2dad34126753d
SHA51295140317a94f0958e97118b59ac3e3edc136f2ff4c0194a91cea17f86978a205058dd33070d8897476e4fafb764402b30f579df200fac8b058e288899423065b
-
Filesize
608B
MD5bcc9f3d7e8453f9b08026d52cb2e2524
SHA1c8fb24f859cda4a677da5e032afe5a552e0d8609
SHA256dec5bbc839ad547bf326b1fd9b0ed932be652ef28e4ba8737dc00e9da43f7481
SHA51257f9d1f8555a956243219e1d5cf5b71e61c499af8a6866a38b626469d3055c486a3bca1977c5c199f34ec1370b5c9ffc5d9ec3a6692d0d01130c7be68c264d57