Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe
-
Size
1.9MB
-
MD5
bacb738917fc969223ad4589dfc36a8c
-
SHA1
5bc1811e831bba83c3584d672840a1b48b915057
-
SHA256
08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab
-
SHA512
d2512baec7a3385e713234199b77f375621708aec7ed63f79332c8f6a04580be8aed8fbb26303c5d499ddf88eee4b105f22d65f15a8fa402b2094a707d5fda81
-
SSDEEP
24576:J7PeGlmIwlIQnl984DD+sHJJqdusszl218pdlUqyT9yV3/5kRR/RFs:JaGlmImHf+spJqdusBeltyhyV3/Ks
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408548dc3d07d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001723c65485f18746b4f021c44c14daae00000000020000000000106600000001000020000000e259addc2a866ea03304ca15ff2e31c2c0b73ec6b0b50ff59fa63c69dc043dfd000000000e80000000020000200000003f3f38794e9f02d5af7af50a8e6c73cea60fc05f98cc480387dfb4f6ac37deb390000000ed091e9f65e23861a2625241d320928b7f7335c58d842dac8e0a26cea2c5d9e160f875bcad9cd69bb4408caefbcd30cf1ffe53dfeb4667579cb94fe85e492e13f10592fc5b2143e1a4c5399276d8734ed964790f8520e7b01a476c264f63a38babd9f2e7413defd5740eafae045d981f59fc80dcb31ffb5a645c98fde81f17d97b45592def3fffa3edd22ecf45bdafb84000000043d56d860109dcbe2f57959f6336345b6f4c0c8b72ec6d32778d19d29382cff7b49d6a3ad82026a0d8c50fb619aea8b2c63ed65a7c42187e94dd339b8c5dbc2f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376853931" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001723c65485f18746b4f021c44c14daae00000000020000000000106600000001000020000000de731aa473aac0fe22da0c981b818366e8191b95c1c0cb1d92d78b2d3ec91cc7000000000e8000000002000020000000a20fe22b1a37392082d1eddb7b0c965e723b5eb8decbaf5c4c012e404333da5520000000350c56b2e3aeb7f87e89c011b8711ac67802af3ef6fd40563b7d066c1982f9bc400000001a5302c21373586ff1a6cea817eb9ac9c5a10b5c09f7a33b4e528a909ea1f45762618904dffb6d9b1edcf80da2318eba4de28848ca637a40073587862bf15804 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0673711-7330-11ED-8FA4-466E2F293893} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1224 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1224 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 1224 iexplore.exe 1224 iexplore.exe 472 IEXPLORE.EXE 472 IEXPLORE.EXE 472 IEXPLORE.EXE 472 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1880 wrote to memory of 1224 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 29 PID 1880 wrote to memory of 1224 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 29 PID 1880 wrote to memory of 1224 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 29 PID 1880 wrote to memory of 1224 1880 08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe 29 PID 1224 wrote to memory of 472 1224 iexplore.exe 30 PID 1224 wrote to memory of 472 1224 iexplore.exe 30 PID 1224 wrote to memory of 472 1224 iexplore.exe 30 PID 1224 wrote to memory of 472 1224 iexplore.exe 30 PID 1224 wrote to memory of 856 1224 iexplore.exe 33 PID 1224 wrote to memory of 856 1224 iexplore.exe 33 PID 1224 wrote to memory of 856 1224 iexplore.exe 33 PID 1224 wrote to memory of 856 1224 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe"C:\Users\Admin\AppData\Local\Temp\08b08646133193718429746efdfe7d693c60bd33c4d6dcb1c22ba1727558e2ab.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.dnfkx.com/2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:472
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:209933 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535B
MD516217c4d8db693efa9b6c281532c2f7b
SHA12cdee5b5893e22725583993f75406e93d26ce4d7
SHA256c1dd4b5e19360dc88517f34f91e96e14637c7c0d6e96a50a5eeb88c6d3c6617a
SHA51281d95d6611640438c0d8bd3c87db6a41493d5b6d8851e420a0eb9600116b966e8c25a1760b3a59017b8cc8246f762390b9cd98fa51bcf29700c42508a7a47a45