Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
247s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe
-
Size
16KB
-
MD5
6d8e6d8409359382519fbe6d43a27d66
-
SHA1
3f2290a9f01ac3384a428cadd0a39d305eacb831
-
SHA256
d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945
-
SHA512
27925b6b7d3de939ec0fac74d4997c7be2b800e6778b9e276f20dd6de1662aca73832b423981591bbe0200b4885b9a8549eb77ef24609c4799e4e2f8338cf70f
-
SSDEEP
384:rwxFz66WAVDoG9LG16gZLZYJ5GOLPH1SiVRPlZjNLFx6p:r8ctAtBQ16CZYfGOoKPFxq
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" http://hao.meiyingie.com/?0001" d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\ = "????(&0)" d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Internat Explorer.url d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 44 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O)\ = "????(&H)" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110} regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z\ = "??(&D)" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\??(&R)\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O)\ = "????(&H)" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O)\Command regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\ShellFolder\Attributes = "10" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O)\Command regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\DefaultIcon regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O) regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z\Command regedit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\ShellFolder\Attributes = "10" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O)\Command\ = "\"C:\\Program Files\\Internet Explorer\\\\IEXPLORE.EXE\" %1 http://hao.meiyingie.com/?0001" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\ = "????(&0)" d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" http://hao.meiyingie.com/?0001" d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O)\Command\ = "\"C:\\Program Files\\Internet Explorer\\\\IEXPLORE.EXE\" %1 http://hao.meiyingie.com/?0001" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z\Command\ = "Rundll32.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\ShellFolder regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\DefaultIcon regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Open(&O) regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\ = "Internet Explorer" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z\ = "??(&D)" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\??(&R) regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z\Command\ = "Rundll32.exe" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\ShellFolder regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\Z regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\ = "Internet Explorer" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\??(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" regedit.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\??(&R)\Command regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\??(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C42EB5A1-0EED-E549-91B0-153485860110}\Shell\??(&R) regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 620 regedit.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Token: SeBackupPrivilege 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Token: SeRestorePrivilege 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Token: SeBackupPrivilege 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Token: SeDebugPrivilege 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Token: SeRestorePrivilege 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe Token: SeBackupPrivilege 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 472 wrote to memory of 1172 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 28 PID 472 wrote to memory of 1172 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 28 PID 472 wrote to memory of 1172 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 28 PID 472 wrote to memory of 1172 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 28 PID 472 wrote to memory of 1172 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 28 PID 472 wrote to memory of 1172 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 28 PID 472 wrote to memory of 1172 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 28 PID 472 wrote to memory of 804 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 29 PID 472 wrote to memory of 804 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 29 PID 472 wrote to memory of 804 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 29 PID 472 wrote to memory of 804 472 d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe 29 PID 804 wrote to memory of 620 804 cmd.exe 31 PID 804 wrote to memory of 620 804 cmd.exe 31 PID 804 wrote to memory of 620 804 cmd.exe 31 PID 804 wrote to memory of 620 804 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe"C:\Users\Admin\AppData\Local\Temp\d165f6e5ee5ec5854a8d0fb8501a625d73b8ac24ae1f37ea56865d54942eb945.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe advpack.dll,DelNodeRunDLL32 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk2⤵PID:1172
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c regedit /s "C:\Users\Admin\AppData\Local\Temp\TempIE.reg"2⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\Users\Admin\AppData\Local\Temp\TempIE.reg"3⤵
- Modifies registry class
- Runs .reg file with regedit
PID:620
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5bf050ae6f7573dbb0823dff030851dee
SHA146de6ffd8e85c6edce14aa9a730ca776cf1fad46
SHA2569d483d5aa98bf9dc97306442769f4703f07e7ea3fce24fedd169e3b15d7385b2
SHA512b708ec524211d7787e4540f2f7c6103720c2f523e26ea4c854558edc734e59bc6a4e14e350b4ebf1af7a75718fe85a7d28e765405f629c9304ef67fa3b246846