Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 19:35
Static task
static1
Behavioral task
behavioral1
Sample
90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe
Resource
win10v2004-20221111-en
General
-
Target
90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe
-
Size
686KB
-
MD5
579de683b042a2a1c7a28655d6729338
-
SHA1
baa623a6de2180ea72c19194172a8d5ff658d556
-
SHA256
90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63
-
SHA512
d78ac81f938aa1ce4a608d1eee06fd60f92ea2735075b1e821831bf5dae5e783bcf831b1b01ab314fd224c0692db33886eb448d37f6bc5fcb0d762f62f861f2f
-
SSDEEP
12288:kvQYieOGmkCcrX4VjvYKVPgp0Df/oPG7qWTHw5lyuZi0mFeYB31uvk:kvxTOOCcrXOsSIp07/Iw/T7uY0m8vk
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000023152-133.dat acprotect behavioral2/files/0x0006000000023152-141.dat acprotect behavioral2/files/0x0006000000023152-140.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1228 Dnrsoenno.exe -
resource yara_rule behavioral2/files/0x0006000000023152-133.dat upx behavioral2/memory/4288-134-0x0000000010000000-0x0000000010129000-memory.dmp upx behavioral2/files/0x0006000000023152-141.dat upx behavioral2/files/0x0006000000023152-140.dat upx behavioral2/memory/1228-143-0x0000000010000000-0x0000000010129000-memory.dmp upx behavioral2/memory/4288-152-0x0000000010000000-0x0000000010129000-memory.dmp upx behavioral2/memory/1228-153-0x0000000010000000-0x0000000010129000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Dnrsoenno.exe 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe File opened for modification C:\Program Files (x86)\Dnrsoenno.exe 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe File created C:\Program Files (x86)\Dnrsoenno.fnr Dnrsoenno.exe -
Modifies Internet Explorer Automatic Crash Recovery 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" Dnrsoenno.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2" Dnrsoenno.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001695" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "NO" Dnrsoenno.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{701F86CC-7852-11ED-919F-DAA3C5DFCF8A} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1295293098" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001695" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1295293098" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2456 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 1228 Dnrsoenno.exe 1228 Dnrsoenno.exe 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4288 wrote to memory of 1228 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 82 PID 4288 wrote to memory of 1228 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 82 PID 4288 wrote to memory of 1228 4288 90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe 82 PID 1228 wrote to memory of 2456 1228 Dnrsoenno.exe 84 PID 1228 wrote to memory of 2456 1228 Dnrsoenno.exe 84 PID 1228 wrote to memory of 2456 1228 Dnrsoenno.exe 84 PID 2456 wrote to memory of 2524 2456 IEXPLORE.EXE 85 PID 2456 wrote to memory of 2524 2456 IEXPLORE.EXE 85 PID 2456 wrote to memory of 2524 2456 IEXPLORE.EXE 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe"C:\Users\Admin\AppData\Local\Temp\90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Program Files (x86)\Dnrsoenno.exe"C:\Program Files (x86)\Dnrsoenno.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer Automatic Crash Recovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42.9MB
MD55f7aba8dd0b1d309bb88373781e08d93
SHA1f7b07ffa48eea86114e5c3cb60eb82ddb27c218d
SHA2563d397c135a5cc8acceaa51189e45b50d1c259169d2457758d2561e841c77eb51
SHA512f39009333d812cc9db20481c18fca22e1772339cdb52aae42856d848040a8ff34410f2fd6e0014e89134b9d57c5225acccb00568d453d9dfdc5d671f7f209942
-
Filesize
42.9MB
MD55f7aba8dd0b1d309bb88373781e08d93
SHA1f7b07ffa48eea86114e5c3cb60eb82ddb27c218d
SHA2563d397c135a5cc8acceaa51189e45b50d1c259169d2457758d2561e841c77eb51
SHA512f39009333d812cc9db20481c18fca22e1772339cdb52aae42856d848040a8ff34410f2fd6e0014e89134b9d57c5225acccb00568d453d9dfdc5d671f7f209942
-
Filesize
72KB
MD5f79ee77a4f30401507e6f54a61598f58
SHA17f3ef4945f621ed2880ff5a10a126957b2011a17
SHA256cf8e29720823eb114fbc3018569a7296ed3e6fcd6c4897f50c5c6e0e98d0b3f8
SHA51226ccde784b06c46f60fb5a105c806c4d9dc1497fd79d39728fbcfa869d470ca2ba018b0665f3cbc05019fb0766dac2eb1084a6fdce2f9aaaae881beb09dd3739
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
409KB
MD5c3d354bdf277263b13dca264ec2add9d
SHA1b428dfd7df0f6024e22838823cc702e2293bd314
SHA256ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f
SHA51224c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e
-
Filesize
409KB
MD5c3d354bdf277263b13dca264ec2add9d
SHA1b428dfd7df0f6024e22838823cc702e2293bd314
SHA256ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f
SHA51224c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e
-
Filesize
409KB
MD5c3d354bdf277263b13dca264ec2add9d
SHA1b428dfd7df0f6024e22838823cc702e2293bd314
SHA256ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f
SHA51224c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e