Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe
Resource
win10v2004-20221111-en
General
-
Target
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe
-
Size
108KB
-
MD5
7598894da8edc3789738d94d3805cca4
-
SHA1
5846ad1ef331f789f87fcd02e7f32ce6b827f935
-
SHA256
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
-
SHA512
3770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
SSDEEP
3072:PlQlfL6lFuWb+z76n2NrvGxf+7RgXUMub8:gfL4aP6+7Gxf+7Rb8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1684 Akarar.exe 284 Akarar.exe -
Loads dropped DLL 2 IoCs
pid Process 1124 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 1124 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Akarar = "C:\\Users\\Admin\\AppData\\Roaming\\Akarar.exe" 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1492 set thread context of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1684 set thread context of 284 1684 Akarar.exe 29 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377124467" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D197D921-75A6-11ED-A03D-460E09B1FADA} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1124 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 284 Akarar.exe Token: SeDebugPrivilege 1568 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 464 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 464 IEXPLORE.EXE 464 IEXPLORE.EXE 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE 1568 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1492 wrote to memory of 1124 1492 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 27 PID 1124 wrote to memory of 1684 1124 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 28 PID 1124 wrote to memory of 1684 1124 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 28 PID 1124 wrote to memory of 1684 1124 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 28 PID 1124 wrote to memory of 1684 1124 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 28 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 1684 wrote to memory of 284 1684 Akarar.exe 29 PID 284 wrote to memory of 1488 284 Akarar.exe 30 PID 284 wrote to memory of 1488 284 Akarar.exe 30 PID 284 wrote to memory of 1488 284 Akarar.exe 30 PID 284 wrote to memory of 1488 284 Akarar.exe 30 PID 1488 wrote to memory of 464 1488 iexplore.exe 31 PID 1488 wrote to memory of 464 1488 iexplore.exe 31 PID 1488 wrote to memory of 464 1488 iexplore.exe 31 PID 1488 wrote to memory of 464 1488 iexplore.exe 31 PID 464 wrote to memory of 1568 464 IEXPLORE.EXE 33 PID 464 wrote to memory of 1568 464 IEXPLORE.EXE 33 PID 464 wrote to memory of 1568 464 IEXPLORE.EXE 33 PID 464 wrote to memory of 1568 464 IEXPLORE.EXE 33 PID 284 wrote to memory of 1568 284 Akarar.exe 33 PID 284 wrote to memory of 1568 284 Akarar.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe"C:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exeC:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Roaming\Akarar.exe"C:\Users\Admin\AppData\Roaming\Akarar.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Roaming\Akarar.exeC:\Users\Admin\AppData\Roaming\Akarar.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:464 CREDAT:275457 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
Filesize
608B
MD5c8a7f5fbc63e80e3f21c113c99dca7fa
SHA1205cef283d3f31f93ea10a4914f6eb10a6557be1
SHA25604fad3bbcde3767da7c8be93e0714f8b311cddc8f4560a377c4bf77189d9f786
SHA5124a325871fa4af0b83d5ab3e8565a5773ec279f7272d68f134f3866c13cf92a2599fc4b095dbfe1dbe04d1d361906fede811185811db477de18d648d12d265b95
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84