Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe
Resource
win7-20220812-en
General
-
Target
3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe
-
Size
314KB
-
MD5
0e649318a8415b27c06538f8e51fde82
-
SHA1
fecf4a2530922a62bb00bbf04eba1febb0a2bb5a
-
SHA256
3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd
-
SHA512
1cd78f1ac51a10e938bab1f99e13102be3aae6f1efc6c3976ceb9abccb1051dc452d34ee28300dfe4dfbf30776a579d05206f81d704c9f9abb824fcc40d2d7c2
-
SSDEEP
6144:sZvuCYX6bmERmQ5Jfzh1CD6q9A1fSJfYRJ+b39gos04s0yGJVjroPj:stlYXUJzh1CDJ21f47Dd4kUVnoPj
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006658c2978a7e1940a29c6d29e997c804000000000200000000001066000000010000200000008581f87acdce04a62f8461fee4df646b24e02948843128827b5c19b1799cd777000000000e8000000002000020000000801bdc56f8338e6e8bcedfa29b6f51a9771fc44a447e5cca10b2eaae916771a520000000da60108bf9eac80cfe9dc28d86ee47d929eddb7481a83ca4ca5a6a1c7d7fcf7740000000678686b6f91ab14d9ca5b6420266d00d97fbbcc971c16a638b8781a13c381b737ba07a2e8399ab155c3a6b1766197cf370bfc6cb7e87074aac93c2e925ad6129 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377422096" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main 3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3314AD1-785B-11ED-8CD5-EA25B6F29539} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7098d4b9680cd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006658c2978a7e1940a29c6d29e997c8040000000002000000000010660000000100002000000018e2e306f1add6214ba490c9d81c619b33314fd48fa8bb368d8fa0b12d2fcb65000000000e800000000200002000000077ad85dad1ae3ce5c2e8ea9fe076e8a79fc32517ee95fa026957e909a7b1405c90000000ecadbedd50360d084bf23cc25905adba9440981b0ec895d2de114cf919d26c761eb642f09bd85e9a83661e8fa585c4efb043c0f86be585a7cfc3fd6724ad827c621a8965fd669f051cea11f8b4a5cf756c51500722127694c075dd32f863e9bb348d48cc21bd79147153a1468579b1f562d3f76db57f5b44cca48cb70820fd83afd20f25862fbd39d444a00f1f982e81400000004261541b9f56abf1941a3fbde6b3f609ed3c9c12434a790219d9f2abb8ea78ec69ef19fa66be5ea47cbbddf321b87b0dfafb2b607f3a9f53287da38321c7d767 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 324 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1488 3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe 1488 3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe 324 iexplore.exe 324 iexplore.exe 864 IEXPLORE.EXE 864 IEXPLORE.EXE 864 IEXPLORE.EXE 864 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 324 wrote to memory of 864 324 iexplore.exe 29 PID 324 wrote to memory of 864 324 iexplore.exe 29 PID 324 wrote to memory of 864 324 iexplore.exe 29 PID 324 wrote to memory of 864 324 iexplore.exe 29 PID 324 wrote to memory of 864 324 iexplore.exe 29 PID 324 wrote to memory of 864 324 iexplore.exe 29 PID 324 wrote to memory of 864 324 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe"C:\Users\Admin\AppData\Local\Temp\3958be91dec0fe4a91d0136b4796120752f27a6cf442b126e052f2661cc20afd.exe"1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1488
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:324 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:864
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD55bb42d9755f82f439e24b5a68640c42f
SHA159ae5851d30d011b77f54adb7adbf3498dc1560f
SHA256faf8056db980c59ec14e5b6614fc2d5e0da9bcea07e714587aff5e8fdf79bd9b
SHA512fc244efe581e446dc225f0c99e0203def4862befb6fe19944d98bb053ec754183adb5767e00562b0f23dfd83a6610a8b4b6682a74b54009298005310ce3c727d
-
Filesize
606B
MD54b4a267f6d47d306bffa0b924e03fea3
SHA1a7ef0f2dd7800177c0286dda5f73a3ae88e4b667
SHA25685ae18fe77454d05bc0d05f459083005a0fec2d674915a159f720acc758e41eb
SHA512f5faf3e3382ae19b6fba5a07f267ffcb7ab9958df06a9eae9563d7915b5866aae85fe53a3af9f342ab72b176648eabb154b598f03ca4ddd67cdbcf64159bdf4f