Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe
-
Size
14KB
-
MD5
728147348d601bee427b5f16a5dfffa1
-
SHA1
b32b8651ce6e7188b96f339120835f40a07efe18
-
SHA256
9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789
-
SHA512
2b2896df714977c34cfda880ebd21e964301334327645624470f292fb5ceb2b56c87e6e6215a7598fddacb82e99f061b02cdd9fc8ad7e0ac82fcfcf0a4f14d9a
-
SSDEEP
384:nF3vbmwxS6CP8Ks7zrelNg9YeMhUAmJOTbmnZWV:nF3DmwxS6u/4elNg9PJ34
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F804F81-793C-11ED-B4BC-4A12BD72B3C7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b11665490dd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000676969076991034ea43e16ea0ce76a55000000000200000000001066000000010000200000007d7fe2f2d1adfd8ed92d39a8dd5d10e646ad72a7550cf9d317576ca4043efbc4000000000e80000000020000200000007970f534a52f6d940d16a78eae139f6ec92dfe29a54a0c48e40e3e537672f5da20000000789a6613147329e1cd518fbc8a860da6f9b7696885300cc27973e5b2a9a7a06a40000000836c3fc4c356a46977f3b73128d8f2c218da31ea4bb81b5a8585b4377444e411f9d00d9051cbb946932ee2f918fbb75a01937dee9965c38c9bcf8ca5b1398957 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377518575" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000676969076991034ea43e16ea0ce76a5500000000020000000000106600000001000020000000c6246c16a00feff9462fd90123ebb5b23b5f16d9b8b3ac55f0ec92a91273aa4f000000000e8000000002000020000000cb8eb4bc5635d611609157a9aa8c5672e0a4b78101019f58fc555b6d62ae112c90000000e7f9a0a93dbd13a730c67733c3a6cb4e324c1116483317df5dc62f61576e0392fc38dc192f39091ecd68fdb73f3ec8addf618bcc075efa6cfa30496e25853f832245dbfb5612acb367d088379429b56183f82e3f1c65cb20ff21d5a1f7e8faae350e3cb874f29eb800051b2194cf87ab1b62ab0d023d56b20665cd062e79e75f50407b313061bde71e92e4ae7fdc324840000000f9a1f28a04614c2a4642a691e79b76ced26b236dd8c388b608294277862667a3a0f2a1976345182c9ab8f835147f1b5083226e8305c8b3bc95d633746a09e2bd iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1776 iexplore.exe 1776 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 756 wrote to memory of 1776 756 9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe 28 PID 756 wrote to memory of 1776 756 9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe 28 PID 756 wrote to memory of 1776 756 9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe 28 PID 756 wrote to memory of 1776 756 9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe 28 PID 1776 wrote to memory of 1404 1776 iexplore.exe 30 PID 1776 wrote to memory of 1404 1776 iexplore.exe 30 PID 1776 wrote to memory of 1404 1776 iexplore.exe 30 PID 1776 wrote to memory of 1404 1776 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe"C:\Users\Admin\AppData\Local\Temp\9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9e8ea92de5097a4359ebea0142d0da6cf37ec9c8e86fc56ca2c0d34f7ed04789.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5dd724f98a1c6c9623712e106c677f890
SHA11eaddfd1b34fa104a239686253e07e71dbce78db
SHA256a8c2a054307210a1c7f991f6e2158f6b3bac4cf8dce3b5bdea38376c04c51ed8
SHA512c0d5d26c162d470e05dbcdb7b5d9304d303154b2bc6791248c9184a838550095a13832087b4a1448841f76ac884bba306b1785261456aedab36e34f63c8a1bdb