Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe
Resource
win7-20220901-en
windows7-x64
13 signatures
150 seconds
General
-
Target
e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe
-
Size
956KB
-
MD5
91e26fcd287123ed5f93bb043a90f7b9
-
SHA1
943e3c924803575b44e744346a8838f7e36a5d01
-
SHA256
e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9
-
SHA512
31f39ed1363d4877c0ae53a6e5eb4d469e6f005171d2fd456af83012a975e5718707ac2abfffb55d2b829dccfd00dceeb0cfa93bc1b276d34ae68d384a6a77a6
-
SSDEEP
12288:3GdJmDSu3lBI4KMWhT8txw8HG4xX7/oQ0BONx35ApaGrJ5E6iWIrrT+BBgUs:3GdOnBkZqa8xXcYb5AEuj5IrI6v
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral2/files/0x0007000000022e42-138.dat family_blackmoon behavioral2/files/0x0007000000022e42-139.dat family_blackmoon behavioral2/memory/1116-140-0x0000000000400000-0x0000000000421000-memory.dmp family_blackmoon -
Executes dropped EXE 2 IoCs
pid Process 1116 install.exe 1980 csrss.exe -
resource yara_rule behavioral2/files/0x0007000000022e41-133.dat upx behavioral2/files/0x0007000000022e41-134.dat upx behavioral2/memory/1116-140-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\install.exe e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1EAC67C2-77B1-11ED-BF5F-DAB196BEBF97} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb00000000020000000000106600000001000020000000304632bbc2437c0ad644f7617973af8a3269857260c8649b3985537a9ff173f1000000000e8000000002000020000000892ea5dde7ae6c362e86833e0607a52af23d236953b67043b430a00bd863c39a20000000d31593065b7982c534cc239d740d912106f486b89ec58fc860f07afdcf6f7a164000000003704c37d1a4b14eefe006d9c4e93c3fbd5a270a9b202488426a2c5328be97bec9fd12be048b56a1d63d0468c86317d093ca41493944be1ad15ee52d25aa110a iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09f3f0fbe0bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e012ef00be0bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb0000000002000000000010660000000100002000000025f5fa94b430c1ddf0fc6793cf686f180850561f25757e4fc8510d5e3f80e6a6000000000e8000000002000020000000f61049751a023915f2b0996e4056ae5509ad88ed9a56d1f076161521059a0c1c20000000641e1be9e117172a9871cb90d6ef02398e1dc456bf9723ee13049b38c209a405400000008f47a666ebb01eb047e7d692c98c836f8b04ee31d31dbac9083875a2285d57ee373a9f9bd448681b9b8feaa536a34a4229e02f3565f0ac00c1a2f3b31915a153 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377348801" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe 1980 csrss.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4868 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 1116 install.exe 4868 iexplore.exe 4868 iexplore.exe 996 IEXPLORE.EXE 996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4240 wrote to memory of 1116 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 83 PID 4240 wrote to memory of 1116 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 83 PID 4240 wrote to memory of 1116 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 83 PID 1116 wrote to memory of 1980 1116 install.exe 84 PID 1116 wrote to memory of 1980 1116 install.exe 84 PID 1116 wrote to memory of 1980 1116 install.exe 84 PID 4240 wrote to memory of 4868 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 87 PID 4240 wrote to memory of 4868 4240 e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe 87 PID 4868 wrote to memory of 996 4868 iexplore.exe 88 PID 4868 wrote to memory of 996 4868 iexplore.exe 88 PID 4868 wrote to memory of 996 4868 iexplore.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe"C:\Users\Admin\AppData\Local\Temp\e395674bd3eb6188f19eb0f0096614206d53b497e31505eec88c01a3c36b39c9.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\WINDOWS\install.exeC:\WINDOWS\install.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\csrss.exeC:\csrss.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1980
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.guabawg.com2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4868 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:996
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5f6013f9e2396fce1f8ac9974a7649a65
SHA157c09ce7d3638c84a3ac47e1b06cb0dbe13432c4
SHA25635f096463efc6b66821095e5d0266c4f2f0cb145a764857e1041d876e102aa31
SHA51263bc60e79a2231acd893ad1788d5953c4bffa2a85dc3aa0928c6c972a522884f7af3bb4eaac2e9fdad3f961d94a462069486f6bd8cbe60670e9af64512a531d9
-
Filesize
46KB
MD5f6013f9e2396fce1f8ac9974a7649a65
SHA157c09ce7d3638c84a3ac47e1b06cb0dbe13432c4
SHA25635f096463efc6b66821095e5d0266c4f2f0cb145a764857e1041d876e102aa31
SHA51263bc60e79a2231acd893ad1788d5953c4bffa2a85dc3aa0928c6c972a522884f7af3bb4eaac2e9fdad3f961d94a462069486f6bd8cbe60670e9af64512a531d9
-
Filesize
96KB
MD5fe274512e1ee55985df1a050f02b850d
SHA16d8abab449299157a63ba83e5a884d84fa2ef1b5
SHA256fb393396537bfea250a313992f3076e477e49a4e08b3fafa4edc2fc553f2c4b9
SHA512d65c25fce561069afac6da384b4b1586b4a9d34f736ddbbb355ae26832cf47eb3ac09b60e356cf1adf18d5471e601716e1eb75bfeb168db980497c851b48b4f0
-
Filesize
96KB
MD5fe274512e1ee55985df1a050f02b850d
SHA16d8abab449299157a63ba83e5a884d84fa2ef1b5
SHA256fb393396537bfea250a313992f3076e477e49a4e08b3fafa4edc2fc553f2c4b9
SHA512d65c25fce561069afac6da384b4b1586b4a9d34f736ddbbb355ae26832cf47eb3ac09b60e356cf1adf18d5471e601716e1eb75bfeb168db980497c851b48b4f0