Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 14:51
Static task
static1
Behavioral task
behavioral1
Sample
8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe
Resource
win10v2004-20220812-en
General
-
Target
8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe
-
Size
361KB
-
MD5
364042307f2355a2fda16afe8706ccb1
-
SHA1
1c7ebaa618624e5c97e24cfaf0f0b00ce9fc8ca0
-
SHA256
8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120
-
SHA512
c30c9a090ace855bfaab937fe9c165c6e82235bfb690426402f3d23369989dde82e63b90d94e642b09ddf4bacc681f9023725da5655db6ca6fe877b44d21d0c8
-
SSDEEP
6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1968 idzsojxtlhdzvfbx.exe 1200 CreateProcess.exe 524 dzwtpmfczv.exe 580 CreateProcess.exe -
Loads dropped DLL 4 IoCs
pid Process 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 1968 idzsojxtlhdzvfbx.exe 1968 idzsojxtlhdzvfbx.exe 524 dzwtpmfczv.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 584 ipconfig.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44FAE9F1-7112-11ED-AEF5-42FEA5F7B9B2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ba542e1f05d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008fb465b94f93e646a6804a17bf29c275000000000200000000001066000000010000200000004a23f39391e26af63be7649ff359ca105dc14d66fc73cbf5159c8b1ac5bc058f000000000e8000000002000020000000dd2b87a4e95c68d5d67be72637233d9520bed8e2efd937763ffd50a1abaad0e720000000ff9ee5466a8e9ca65cb895b4aada922b998500aa3a846f3b1be45643c5f8ef6140000000f0f78be7bf828b654de59d3f1a8e054f47085e897f6389b3e68868c5c0efc5a01ae63d50af9d2ab53426f0b3dbdd025f9dbde31ff07e616426a677977ddd6291 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376620868" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008fb465b94f93e646a6804a17bf29c2750000000002000000000010660000000100002000000034fb08bab0cc46f0f6097e2f214eb68ed91184ed702fa5ec1cec5ca63ba76256000000000e80000000020000200000003609a032e17624916efc80a16753d72fa8a2d34b346659c003742915dd4e70fb900000002ae98bf27ab3fe2a33ff484e8539e112160d9c9ec593ab8bd480ab8ceec99b7eb87781f1119ec6f83b28edf309e6d6037828bc66c02e65074878abc2c37704e0cb184a7fed0e06eb3c4056f8ca2f6580362e712faace016944eb7bc6e2346fe4190e4f65460b3622926ba390021cddb437ccbd0f3efb7161b8cd05628e1e22286efff3151cb1b0b412dcc2488d2830b340000000bf5b65fa0b314a6454bbf8b04986306262ab0b933a3b9cf9767e788f70284fe301ab0629471fcc92ad4876d9c68858ea5f0b23da4e8e6afbeaf1a82a7a6d7d3e iexplore.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 1968 idzsojxtlhdzvfbx.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 1968 idzsojxtlhdzvfbx.exe 1968 idzsojxtlhdzvfbx.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 1968 idzsojxtlhdzvfbx.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 1968 idzsojxtlhdzvfbx.exe 1968 idzsojxtlhdzvfbx.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 1968 idzsojxtlhdzvfbx.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 524 dzwtpmfczv.exe 524 dzwtpmfczv.exe 524 dzwtpmfczv.exe 524 dzwtpmfczv.exe 524 dzwtpmfczv.exe 524 dzwtpmfczv.exe 524 dzwtpmfczv.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1552 iexplore.exe 1552 iexplore.exe 700 IEXPLORE.EXE 700 IEXPLORE.EXE 700 IEXPLORE.EXE 700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1968 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 28 PID 2004 wrote to memory of 1968 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 28 PID 2004 wrote to memory of 1968 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 28 PID 2004 wrote to memory of 1968 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 28 PID 2004 wrote to memory of 1552 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 29 PID 2004 wrote to memory of 1552 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 29 PID 2004 wrote to memory of 1552 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 29 PID 2004 wrote to memory of 1552 2004 8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe 29 PID 1552 wrote to memory of 700 1552 iexplore.exe 31 PID 1552 wrote to memory of 700 1552 iexplore.exe 31 PID 1552 wrote to memory of 700 1552 iexplore.exe 31 PID 1552 wrote to memory of 700 1552 iexplore.exe 31 PID 1968 wrote to memory of 1200 1968 idzsojxtlhdzvfbx.exe 33 PID 1968 wrote to memory of 1200 1968 idzsojxtlhdzvfbx.exe 33 PID 1968 wrote to memory of 1200 1968 idzsojxtlhdzvfbx.exe 33 PID 1968 wrote to memory of 1200 1968 idzsojxtlhdzvfbx.exe 33 PID 524 wrote to memory of 580 524 dzwtpmfczv.exe 35 PID 524 wrote to memory of 580 524 dzwtpmfczv.exe 35 PID 524 wrote to memory of 580 524 dzwtpmfczv.exe 35 PID 524 wrote to memory of 580 524 dzwtpmfczv.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe"C:\Users\Admin\AppData\Local\Temp\8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Temp\idzsojxtlhdzvfbx.exeC:\Temp\idzsojxtlhdzvfbx.exe run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dzwtpmfczv.exe ups_run3⤵
- Executes dropped EXE
PID:1200 -
C:\Temp\dzwtpmfczv.exeC:\Temp\dzwtpmfczv.exe ups_run4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:524 -
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
PID:580 -
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
PID:584
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:700
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD51c2e3a061866235f2d3a53a5bb0f30ea
SHA143e77de1758fabd4ce4f9ef0caa94dc9616e3f49
SHA256cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226
SHA5124d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8
-
Filesize
3KB
MD51c2e3a061866235f2d3a53a5bb0f30ea
SHA143e77de1758fabd4ce4f9ef0caa94dc9616e3f49
SHA256cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226
SHA5124d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8
-
Filesize
361KB
MD54d1edb8c8fb55848518f87d114b0535b
SHA12cbc3a0866e220d973979967fbbfe35c6d8929c7
SHA256ec6c82b029e79e25157225f1483a8e29c21e58709c9211b7cbd202e75b244a42
SHA5128038dde23f09ec1064ca0075296d986c1de2d2bfaa375e6bf87271697de38691114adbef8a21e5abb259c7355119cdce38ccd0314a50e239fca54095568d949f
-
Filesize
361KB
MD5ecc41986108e2643945029264324a6b1
SHA16f4f0de6765d9cfbb0941344cf3409ae686d60c9
SHA256c6e952203694013ac04cdb76885184088dc93dde38dd1ef0713472ddba2a9bc3
SHA51266e85267864131c8ae1e587d026e687b99290df15ce85ba75147d6b4a45be9abb0f04d9315b87d4a67cdd603b82af18ec71a8dee73b2a255e4ebb3e9cb5c0e71
-
Filesize
361KB
MD5ecc41986108e2643945029264324a6b1
SHA16f4f0de6765d9cfbb0941344cf3409ae686d60c9
SHA256c6e952203694013ac04cdb76885184088dc93dde38dd1ef0713472ddba2a9bc3
SHA51266e85267864131c8ae1e587d026e687b99290df15ce85ba75147d6b4a45be9abb0f04d9315b87d4a67cdd603b82af18ec71a8dee73b2a255e4ebb3e9cb5c0e71
-
Filesize
535B
MD5e873841969698b3ff18555ed826ff29b
SHA1750b6abba27f27842c49eef65c70523a46d45f22
SHA256b224a04d6d720e2d6f1021294b9e12f01576faa4141ea7e5015d2d641493b05f
SHA5120af776395bf9f0627652e50e580cc96bef5e199339340fb2eed2984321dbb4bc40027192ccddf504ba8f4726d1680cc6447efbb7d35afe6f3c215c7bd34a220f
-
Filesize
3KB
MD51c2e3a061866235f2d3a53a5bb0f30ea
SHA143e77de1758fabd4ce4f9ef0caa94dc9616e3f49
SHA256cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226
SHA5124d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8
-
Filesize
3KB
MD51c2e3a061866235f2d3a53a5bb0f30ea
SHA143e77de1758fabd4ce4f9ef0caa94dc9616e3f49
SHA256cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226
SHA5124d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8
-
Filesize
3KB
MD51c2e3a061866235f2d3a53a5bb0f30ea
SHA143e77de1758fabd4ce4f9ef0caa94dc9616e3f49
SHA256cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226
SHA5124d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8
-
Filesize
3KB
MD51c2e3a061866235f2d3a53a5bb0f30ea
SHA143e77de1758fabd4ce4f9ef0caa94dc9616e3f49
SHA256cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226
SHA5124d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8
-
Filesize
361KB
MD5ecc41986108e2643945029264324a6b1
SHA16f4f0de6765d9cfbb0941344cf3409ae686d60c9
SHA256c6e952203694013ac04cdb76885184088dc93dde38dd1ef0713472ddba2a9bc3
SHA51266e85267864131c8ae1e587d026e687b99290df15ce85ba75147d6b4a45be9abb0f04d9315b87d4a67cdd603b82af18ec71a8dee73b2a255e4ebb3e9cb5c0e71