Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
Resource
win10v2004-20220812-en
General
-
Target
4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe
-
Size
164KB
-
MD5
16a4f72a115d2ba72770bbc53dda8d50
-
SHA1
e8a1167df93b6f5cc40cfa8f78fa14144b8735b1
-
SHA256
4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b
-
SHA512
2d2b8a4dceebf0a6576c6b979e30ba476e060e99ffd36a26b8966ec18cc287e099a46db6d39732be52a42432c38de49ca573062e03395abd0ffbd140addbd530
-
SSDEEP
3072:wJfrOsX6d5/hadTRl6ZghWyZokJZ1dTzcTWyQ9:kqKahadTPOspJZvT
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1732 set thread context of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376822158" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F296B141-72E6-11ED-A993-42FEA5F7B9B2} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe Token: SeDebugPrivilege 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe Token: SeDebugPrivilege 1768 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1204 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1204 IEXPLORE.EXE 1204 IEXPLORE.EXE 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1732 wrote to memory of 1692 1732 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 28 PID 1692 wrote to memory of 1700 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 29 PID 1692 wrote to memory of 1700 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 29 PID 1692 wrote to memory of 1700 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 29 PID 1692 wrote to memory of 1700 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 29 PID 1700 wrote to memory of 1204 1700 iexplore.exe 30 PID 1700 wrote to memory of 1204 1700 iexplore.exe 30 PID 1700 wrote to memory of 1204 1700 iexplore.exe 30 PID 1700 wrote to memory of 1204 1700 iexplore.exe 30 PID 1204 wrote to memory of 1768 1204 IEXPLORE.EXE 32 PID 1204 wrote to memory of 1768 1204 IEXPLORE.EXE 32 PID 1204 wrote to memory of 1768 1204 IEXPLORE.EXE 32 PID 1204 wrote to memory of 1768 1204 IEXPLORE.EXE 32 PID 1692 wrote to memory of 1768 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 32 PID 1692 wrote to memory of 1768 1692 4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe"C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exeC:\Users\Admin\AppData\Local\Temp\4da9f92d28de874298753061a63b7843e4fa03bc2fec3bddc4124dbcbb18da6b.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1768
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535B
MD5846c9ac1bb9c56d4372b844dfe816258
SHA1d52c770456b35caefed4dfb1102356277d3a72c9
SHA2561ae1dd2016a18b1c9a6a90111dc9c38480878d7cd4398003bc943992d526c69c
SHA5124491efd1bf5212e70d706a4f546f27b8fa3f29b8a593dfc6ebb8cf2831ffa6832d5939bbcad234db32f88fc85d12f8533d0f1ba485b24b9cfb00a23c757e6485