Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe
Resource
win10v2004-20220901-en
General
-
Target
0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe
-
Size
143KB
-
MD5
14274b2c7852ea88381c9267ffcca069
-
SHA1
00575f10993b892b33ade4378bc8c1824d7b3580
-
SHA256
0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203
-
SHA512
16450cb85fd158346218f5415200b870f54bf6b769a5dc98bf9d338127fba60dce33e52bcb9fbdf77d26b84a2e54d687116178ac59b58b4bc739311c7f18bb06
-
SSDEEP
3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45Dn7:pe9IB83ID5z7
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006135be4543b10b4fac0568f24c807c560000000002000000000010660000000100002000000035a536f59ea197bdbe814f9e36f83b286f12d2ccd4f8a2565d8c1a14342e08b5000000000e8000000002000020000000064fc8f1f4b6a04b2eeb89357b0c75056dc239efa643d41d47f163fc0c3ac66f900000002c31b14a2d915b953c7c06029c6ce85034837f95944c306de58627cae519b5c58ca939b3125bba7eadfe94cfb9cb08f4d11c2e14e6078ed6554f234b9293dad90f2fa1733db4e4063566abbb82b2048914eff4fe779db05808960690c486b3dd5a2d05cb1690d545ca527c91e5581a2d37908005c112263d452f1fd3491c4f8f580e67a0eab3fabab18e52e1d4e3f10c40000000ab1d5ae691147ab34bc3729693a523a837cb8ff3d227f8c82df8975e467cfdf9f6b8493d701e85b665091d2c474c0502449d6ca40f96cddbd23a37b1c867a1aa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16584D81-6F1A-11ED-A503-626C2AE6DC56} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d62df62603d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376404313" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006135be4543b10b4fac0568f24c807c560000000002000000000010660000000100002000000030a2d27fa910e7258f6ff98fd67a6735e8afc821f4f1134bec2893d46213d52e000000000e80000000020000200000003a42101e05ed7c4b252754c5280873898ab99c5015e6412c426694d0128235fc20000000dc204b61a6ed7a65cf7c5cb1d98b48be8b4a4b23e2871bd2572b85b95a4656c2400000009d4d2d115001b9b6ceb89dbeae1a354b73fc9dec325c848d52c28fd8f614d0a8e09c1eb062cd3412bdfed84a4da250a9f0264a1b1c44db6fc30022c120549393 iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1516 0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe 1244 iexplore.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1516 0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1244 iexplore.exe 1244 iexplore.exe 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1644 1516 0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe 30 PID 1516 wrote to memory of 1644 1516 0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe 30 PID 1516 wrote to memory of 1644 1516 0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe 30 PID 1516 wrote to memory of 1644 1516 0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe 30 PID 1644 wrote to memory of 1244 1644 cmd.exe 32 PID 1644 wrote to memory of 1244 1644 cmd.exe 32 PID 1644 wrote to memory of 1244 1644 cmd.exe 32 PID 1644 wrote to memory of 1244 1644 cmd.exe 32 PID 1244 wrote to memory of 1696 1244 iexplore.exe 33 PID 1244 wrote to memory of 1696 1244 iexplore.exe 33 PID 1244 wrote to memory of 1696 1244 iexplore.exe 33 PID 1244 wrote to memory of 1696 1244 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe"C:\Users\Admin\AppData\Local\Temp\0bfa2cc0d03575db5073e3482c0179307ba142b23d78c4b7a1cca8f8ee6eb203.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=4300109^&rsn=plde^&details=^|v6.1.7601x64sp1.0ws^|tt34^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://securedfileinfo.com/404.jsp?chid=4300109&rsn=plde&details=|v6.1.7601x64sp1.0ws|tt34|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p13⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1696
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD57ef66f502cb164d6d88fd779895d5e07
SHA175c68e887afe0041c18bc01dc36ae719db07a436
SHA256084f8949af79ac48c5c245e4bbeea807949d1e8e182e7d0487227231fcd97a77
SHA512419b6e5def7e1051af856ea4256235fa4f1bdbf001b54f1db9e59c44f7da8f9cfa8d63f77e35345ec6d5c3ab13de10094281d44f42a7e1fd9d92b3b68ac5ba9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize472B
MD503ad9fc0b00b5df3165dc2fb1e3b0a3e
SHA1f8243335a8bc24d989bddd346048a055e1d0bdeb
SHA256366b28d491f7fd632e31c1ce97f939555f7dcee14bb6875737ed2d3e96fa32ec
SHA512a3cd8a001366e6c1b96d2b920d56e6efd34e9b69b9805e1a2b0c270346712e22420366f8bd18bbb1dd16fa60d481ad65b13385a66a3f1fa0d7aadaaa27b99796
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5063a50cbc4917175937023da67f38659
SHA14dcf57234f59af687bfa98e7c87fdf7b34a9688d
SHA256bb5e5ac3ea70c33664275bb2eef3c4a59034a37b63b10d46226592eb9c8fd51a
SHA51243a839d1a748efa321b5550d3d540b953159deeb24ff9cd6fab905e6951a3d1f9ad58e1890132ccb7632bdc814792858c1edeb88cd9e6ce7f0a86350ff1b87f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4
Filesize402B
MD596ce375bf1dfdfbabd413baa9be58245
SHA1b3efade71938fcb1b355844e9cc61b9c0bb59741
SHA2562dedcae24b75eb6209fb254e8d446d5dd63502b617ed153fa252ce9a76c015ad
SHA5121664bf586426f9712a77dcdd8b181bf2049762c5dd6b6ed27fd1cf0c970aaf04f0010215c1d78edeffdb74b36113bf1a44fb97a0656cfc05657e147752d56c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD5da341c58bd238fc5eb0c85624b7aaf05
SHA17730176ea0a18131e98895e3ce8a6086069112ca
SHA2568df330153674390b7dc4f99fb4a0ffc1f93fa6534f597f2cfb23e8d85b84d7ef
SHA512e10c7bd738b2030ec1cb866ec4d70332f0b9c097ce1ed1b733c293db098c391fbe533c2da6ee3b3f2c50df3524b8bad200b8d1a0e14f94cf2298a92a4cef7045
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5d2fabe8eb7a1599e76dfc0eb828c1e67
SHA182e0774364f3b6e26c73c67f905aac635abcb88a
SHA25635c5f34974a1eb037016b6d2bfa51b18c0b0f9535e09d50096ae2400ebf85090
SHA512368c0b3ead7bd8fea8ca22a2d1b8074fcdbbe68d8b4b43280d7394fcca053db25962ecd060f67b3f82362804a146298960906041d24f58d47e8cbb601096820e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a1e21d8715147e9526a5523e6e828523
SHA158690e3aa1d910fa2defaad16de5fb862276f885
SHA2568515cc6f5cf3270aa52625c54494c048d022b3e81583d8829ba102dcecf32de3
SHA51264a12624e460fb0e14c32c8b6659e31bf42819247ad8e4257abb5799cf055d55cb2002026967c957aff4682ac9edd83199654d9bb69c44ffac182fdc98b4d433
-
Filesize
595B
MD5e32db3d331fd932f4b6c8907504ab7c1
SHA14b2ac18db26c6238aa9f5e0e04265342b919d432
SHA2566772c6074e5a1c38c01984b0c75a3385aa05114efa412380e7bd70e628b6038a
SHA5121eedce1402fe30b4b3f66f6bed28e9cb6b8e84a1b1d2780b3d4f36ba81397dc04b1a4ba621b6485c3b69d1719f7a6a910d4845c7a3036928ee2689f1a6bbfab2