Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
271s -
max time network
352s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll
-
Size
173KB
-
MD5
79e0c98ede7fd1e21dd10a80de5454e0
-
SHA1
3c864994347bae76ebede61e91cc4b6047c484f1
-
SHA256
a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec
-
SHA512
6fc29a7c8464953a33cb92b5b161d5944fcb5db4b9a92b4508a416edc92c2e19e1951d11963ea04bd9ebc031825904466a1f8cf30b321f48f71d840cbce1a5b6
-
SSDEEP
3072:foKMQavV343xtXDPM0z0j52+BnSL4NcR7aftNSFT5J9ZUSiq79wjgkvnfNRHD2:6QavB43xtTPj+JSL4qRWNiZUSiq7WMkf
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll\",ARawDecodeInit" rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BD01D41-77D2-11ED-8A0C-D60BF964997B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1304 iexplore.exe 1304 iexplore.exe 1304 iexplore.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1304 iexplore.exe 1304 iexplore.exe 1640 IEXPLORE.EXE 1640 IEXPLORE.EXE 1380 rundll32.exe 1304 iexplore.exe 1304 iexplore.exe 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1380 rundll32.exe 1304 iexplore.exe 1304 iexplore.exe 924 IEXPLORE.EXE 924 IEXPLORE.EXE 1380 rundll32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 516 wrote to memory of 1380 516 rundll32.exe 28 PID 516 wrote to memory of 1380 516 rundll32.exe 28 PID 516 wrote to memory of 1380 516 rundll32.exe 28 PID 516 wrote to memory of 1380 516 rundll32.exe 28 PID 516 wrote to memory of 1380 516 rundll32.exe 28 PID 516 wrote to memory of 1380 516 rundll32.exe 28 PID 516 wrote to memory of 1380 516 rundll32.exe 28 PID 1304 wrote to memory of 1640 1304 iexplore.exe 31 PID 1304 wrote to memory of 1640 1304 iexplore.exe 31 PID 1304 wrote to memory of 1640 1304 iexplore.exe 31 PID 1304 wrote to memory of 1640 1304 iexplore.exe 31 PID 1304 wrote to memory of 1072 1304 iexplore.exe 32 PID 1304 wrote to memory of 1072 1304 iexplore.exe 32 PID 1304 wrote to memory of 1072 1304 iexplore.exe 32 PID 1304 wrote to memory of 1072 1304 iexplore.exe 32 PID 1304 wrote to memory of 924 1304 iexplore.exe 33 PID 1304 wrote to memory of 924 1304 iexplore.exe 33 PID 1304 wrote to memory of 924 1304 iexplore.exe 33 PID 1304 wrote to memory of 924 1304 iexplore.exe 33
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a51a726f13cb88cdb9e829d826cdcd542ce842898c6496831d6229a2b45530ec.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1380
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1640
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275461 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1072
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:406535 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:924
-