Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
192s -
max time network
225s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe
Resource
win10v2004-20221111-en
General
-
Target
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe
-
Size
108KB
-
MD5
7598894da8edc3789738d94d3805cca4
-
SHA1
5846ad1ef331f789f87fcd02e7f32ce6b827f935
-
SHA256
98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
-
SHA512
3770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
SSDEEP
3072:PlQlfL6lFuWb+z76n2NrvGxf+7RgXUMub8:gfL4aP6+7Gxf+7Rb8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5056 Umvdvx.exe 1356 Umvdvx.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Umvdvx = "C:\\Users\\Admin\\AppData\\Roaming\\Umvdvx.exe" 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4372 set thread context of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 5056 set thread context of 1356 5056 Umvdvx.exe 84 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1245836442" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{723DBCDF-75AF-11ED-919F-DA2886E4F8F0} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001020" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001020" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1244742196" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1244742196" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1245836442" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001020" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001020" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3688 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 3688 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1356 Umvdvx.exe Token: SeDebugPrivilege 3408 iexplore.exe Token: SeDebugPrivilege 3320 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3584 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3584 IEXPLORE.EXE 3584 IEXPLORE.EXE 3320 IEXPLORE.EXE 3320 IEXPLORE.EXE 3320 IEXPLORE.EXE 3320 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 4372 wrote to memory of 3688 4372 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 82 PID 3688 wrote to memory of 5056 3688 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 83 PID 3688 wrote to memory of 5056 3688 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 83 PID 3688 wrote to memory of 5056 3688 98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe 83 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 5056 wrote to memory of 1356 5056 Umvdvx.exe 84 PID 1356 wrote to memory of 3408 1356 Umvdvx.exe 86 PID 1356 wrote to memory of 3408 1356 Umvdvx.exe 86 PID 1356 wrote to memory of 3408 1356 Umvdvx.exe 86 PID 3408 wrote to memory of 3584 3408 iexplore.exe 87 PID 3408 wrote to memory of 3584 3408 iexplore.exe 87 PID 3584 wrote to memory of 3320 3584 IEXPLORE.EXE 88 PID 3584 wrote to memory of 3320 3584 IEXPLORE.EXE 88 PID 3584 wrote to memory of 3320 3584 IEXPLORE.EXE 88 PID 1356 wrote to memory of 3408 1356 Umvdvx.exe 86 PID 1356 wrote to memory of 3408 1356 Umvdvx.exe 86 PID 1356 wrote to memory of 3320 1356 Umvdvx.exe 88 PID 1356 wrote to memory of 3320 1356 Umvdvx.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe"C:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exeC:\Users\Admin\AppData\Local\Temp\98162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Roaming\Umvdvx.exe"C:\Users\Admin\AppData\Roaming\Umvdvx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Roaming\Umvdvx.exeC:\Users\Admin\AppData\Roaming\Umvdvx.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3584 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3320
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84
-
Filesize
108KB
MD57598894da8edc3789738d94d3805cca4
SHA15846ad1ef331f789f87fcd02e7f32ce6b827f935
SHA25698162d5f2d4ab3a4c1dc161a80543d665d1dd8d2852154c7899c6930eff66ebc
SHA5123770b809b512ee69c319333f69087dfd0899f1230bebf34345804160e9507a92eb6316f4b5dda3b3dd2c96b7da88d531cec96b5661f934d9a43bd4885a171c84