Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
258s -
max time network
339s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe
Resource
win10v2004-20220901-en
General
-
Target
a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe
-
Size
143KB
-
MD5
547c8451955b15ff34c32197d92094b2
-
SHA1
46d8c4b205f61a2dcee15b5c7da1402731597335
-
SHA256
a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097
-
SHA512
4bd0ccb03cd95ba36f26d461bc0a582e9fa6e3ffc7cd7fe91604119ae01141bc4f736da26aa17d87e06161ba6d45fb2a72e2b9e7a051a2bfb32926c168746302
-
SSDEEP
3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45Dn:pe9IB83ID5T
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B42CCE1-6EA5-11ED-875F-EED7317926BC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb8000000000200000000001066000000010000200000001ad18c9cd92d5d89adb924a5e7ba2c9659eabff2eeb66c12d5b91adc78faf7b6000000000e80000000020000200000007d16ae2c0e9b7cae6aece0665a30f17a0976cd5d4bcd35697bc001f40fa5bbca90000000abd0dfba0ba4c74f0cfd45aaccd2ac545edd158d3271c0c628731c8ae97a0434aefbb725ac23de0e91effba444ac993f170c87d8157fdacf1540a614e97f710e5365e22375fe5c34ac5d84a6aa7b55b091d084a916933d7d318aec3a322390b2d913a6f5d3af1a287d479d414cd51d53239a75c5150bb6f7387fddb7e20638dcf8e1b7fdfbf36cc2499bce98f2301e494000000002af2728aa284c506c58d96cce8762f52a52735f39458dce30b233040bce0fc54859b56dd39ba43aed344334c1c15585c19c61027541139cd92e368ad36cde1a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7085db53b202d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb8000000000200000000001066000000010000200000008f2928e0fcab7a33eee08e4db60712da84f3d4bdfcaf8ffce3feb6078ca07102000000000e8000000002000020000000bd37fa6690956ce46caece4316d0ddfb69d7102d8f4b6e8474cdb053b018d4912000000092762c092f92cb7163100e23c6dfa7875a017f5293547f38a23276c9bb9b84dd400000002fba6b5550c8e6dcdf893da8bc64b73633645dc04490292f2e42615085e6e7d141d022d190f9fd5b1f434a59ff6f599e4a8be25b1446896b7c997e54d8ac73cd iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1168 a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe 1756 iexplore.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1168 a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1756 iexplore.exe 1756 iexplore.exe 1792 IEXPLORE.EXE 1792 IEXPLORE.EXE 1792 IEXPLORE.EXE 1792 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1168 wrote to memory of 828 1168 a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe 31 PID 1168 wrote to memory of 828 1168 a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe 31 PID 1168 wrote to memory of 828 1168 a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe 31 PID 1168 wrote to memory of 828 1168 a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe 31 PID 828 wrote to memory of 1756 828 cmd.exe 33 PID 828 wrote to memory of 1756 828 cmd.exe 33 PID 828 wrote to memory of 1756 828 cmd.exe 33 PID 828 wrote to memory of 1756 828 cmd.exe 33 PID 1756 wrote to memory of 1792 1756 iexplore.exe 34 PID 1756 wrote to memory of 1792 1756 iexplore.exe 34 PID 1756 wrote to memory of 1792 1756 iexplore.exe 34 PID 1756 wrote to memory of 1792 1756 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe"C:\Users\Admin\AppData\Local\Temp\a29ba458d87ded87e7f67a880db2be3859ce1444501c2bcd4474721d86fa2097.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=5301121^&rsn=plde^&details=^|v6.1.7601x64sp1.0ws^|tt45^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://securedfileinfo.com/404.jsp?chid=5301121&rsn=plde&details=|v6.1.7601x64sp1.0ws|tt45|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p13⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1792
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5f2080851a6780703a0f3764645202ce1
SHA16e16ec7fe0404b0fe43ebd271ca47ffba9fc9588
SHA256d3969401d4fc819669b9ce997251cc41d4883a31c4f43271b088944fadce3a83
SHA51250e5661d1b5c66073c34d164b49733d7c1c1d7b2782611596646b60dae81321c5c92f9e64dce980cea8306b29db6136e582dcc07f1a951580c1f9f4d69643121
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize472B
MD59f6cc8d3fe9092a6d3901e873a87fd87
SHA12e0aac117a4cc57596efb3d6f6624c269f94b031
SHA256e73982e62b92abac3d15b161f4525448cc2bc8b9bacefdcbfc6f87b74ec372e4
SHA5129736a099967d7ad595439768e45c633ff7d34de92f7cb0c19cd3d4590c4a6dd4fedfcd1b5617c81652e61f4ffe919057507f622f4c6d8d626cfc40234ad2c757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD55d49720ef47af8aaf174ce2af12b63f6
SHA1104d20fc8163749bdc6c9930e49266dea2a6d904
SHA2565c86b4e8f5327cac794dd89466271a651dc36c3517654b2f9b267a25ba49c992
SHA5126bc4a029cc8d2d6ea2fa73e8b13b6b5b17010d985727eb4814070aa2119c2defb14b7f26aedeb63961fd6988884de1a6c28ce9949059d395cd6f4500469d8479
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize402B
MD5735eeb751d2fe99ddf59968d03f02bd7
SHA133087c3b74872b7f3a8f36a1e6c857ffa0a625ed
SHA2569bb90a32fb9913f75338181ef5f61689e11ed1589b39460a85d4cc9fd7956aef
SHA51252b3b6909b12c85c42b22eebd1d7a762159f97f542a89e009cc11b3728345ee5a80573bfc2b41b45f0a7e13fcd28b4b8bd1472988d5ed6a1f6cf53f1b2f4543b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acb5587318120443f98ab9a0fbac6bcf
SHA19f839130b3b7161f3662c1177745bb9f61df6c21
SHA256dd960c9d0c9d816785eec2a93d353f6ace0a1ce9f695e6bc2d24c4cedc185a22
SHA512b4ab843f31ffdb68e1ffa3feffa0a646a16a82b112eafe9a13276191842cd8cd93786653c3b3cafe2e46f6abce91fd30c2362c3eb03d2e07ba3aab2298cbe7e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5b3c299e89550f4755e24239037e4cd3e
SHA1721c3fee857261c61a4ce8d0cc1e6b493c84c310
SHA25685093c47a5567a0996573ee21c7a2dcda4197d579515db347036a5fd9f5ff214
SHA5124ad8e8c3303d73671c33248c0d6d7ec3f7d41f9a22925ad023f4c18311f9039f22e5002ba634e6c7b68df73eb01202907cd8a52ae29ae438b13bb83043bb6bc4