Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe
-
Size
137KB
-
MD5
1eae5e7b0aa7d7d7bf08b9bdaddddac0
-
SHA1
632e70ddd185f3198473ff706a569a4e2c6ddc79
-
SHA256
684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609
-
SHA512
bebec15aa16c7fc21cc7d75731f97fb79591b8258e331f7643739e9af860dc1d93b08ef07e60c402a75c6efa6f5e0c747ae31111f7e2314c2c55e994e388e5b8
-
SSDEEP
3072:VEsUqjkvgA+rROXqDvZ4e/hCL3CQ9vnkuOfpYoizXKv6tF/JQEgUlW:5pjqgAvsR4e5CL3C+vdOfppIXKSNrpU
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Screen Saver Pro 3.1 = "C:\\Users\\Admin\\AppData\\Roaming\\ScreenSaverPro.scr" 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Usmjmd = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Usmjmd.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\J: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1092 set thread context of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 4500 set thread context of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377386774" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8F418134-7809-11ED-AECB-D2A4FF929712} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1680904631" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001622" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1716842903" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001622" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001622" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1680904631" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4932 mspaint.exe 4932 mspaint.exe 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2420 IEXPLORE.EXE -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe Token: SeDebugPrivilege 5048 svchost.exe Token: SeDebugPrivilege 4932 mspaint.exe Token: SeDebugPrivilege 1580 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2420 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4932 mspaint.exe 4932 mspaint.exe 4932 mspaint.exe 4932 mspaint.exe 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 1092 wrote to memory of 4500 1092 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 79 PID 4500 wrote to memory of 5048 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 4500 wrote to memory of 5048 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 4500 wrote to memory of 5048 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 4500 wrote to memory of 5048 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 4500 wrote to memory of 5048 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 4500 wrote to memory of 5048 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 4500 wrote to memory of 3324 4500 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 81 PID 5048 wrote to memory of 4932 5048 svchost.exe 82 PID 5048 wrote to memory of 4932 5048 svchost.exe 82 PID 5048 wrote to memory of 4932 5048 svchost.exe 82 PID 3324 wrote to memory of 1452 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 86 PID 3324 wrote to memory of 1452 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 86 PID 3324 wrote to memory of 1452 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 86 PID 1452 wrote to memory of 2420 1452 iexplore.exe 87 PID 1452 wrote to memory of 2420 1452 iexplore.exe 87 PID 2420 wrote to memory of 1580 2420 IEXPLORE.EXE 88 PID 2420 wrote to memory of 1580 2420 IEXPLORE.EXE 88 PID 2420 wrote to memory of 1580 2420 IEXPLORE.EXE 88 PID 3324 wrote to memory of 5048 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 3324 wrote to memory of 5048 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 80 PID 3324 wrote to memory of 4932 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 82 PID 3324 wrote to memory of 4932 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 82 PID 3324 wrote to memory of 1580 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 88 PID 3324 wrote to memory of 1580 3324 684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe"C:\Users\Admin\AppData\Local\Temp\684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe"C:\Users\Admin\AppData\Local\Temp\684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4932
-
-
-
C:\Users\Admin\AppData\Local\Temp\684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe"C:\Users\Admin\AppData\Local\Temp\684f2b0f0154b876eb43841cb3a35ce25e319d85d826d688c12b0ffaa81c3609.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1580
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD52e02780939de763a8bb3e91dfbf21980
SHA147e818dcbc1d307b43654dfe3a03b9a7625d9ce4
SHA256971abb405a443302f8c61627933bd0f46ed6953f5815e298974e6f7532908748
SHA51251709ae31e885719d848f619c4b3e732b0765a5349484f7c4ca524072a6b0d75f33d3f6c015a0ed4fd188a43d5cc9e0d221d1d7cca5a31a044b73fcbcebbe5fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5729c0b2b6e6a7730fea9ecf2ddb65d2c
SHA116925e8c55ffdc5f5cee0874f01ab91b89837e0d
SHA256f5de025757754ce8b3196f8cef8ce4bc832cb9e2ed521c3a7e17b8d667ecf54f
SHA51241fb8fb62ec4e06a27817bfe8eec857755baaaa45594bd985fdaf20b81fa69d4b5adde08318eaf97ec576a9bb89abd681ad920fbddaad0a7c0909b9886da6b87