Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe
Resource
win10v2004-20220901-en
General
-
Target
918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe
-
Size
112KB
-
MD5
4674566e25e78bb4f4ab7a8a1c86f9cb
-
SHA1
adb83767f85dc9e6270ca934c51bd87203816086
-
SHA256
918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f
-
SHA512
9e5ba5a481f7f4c7671615b1861f077976e76a87467b5fe1a45556b68b2e78265ae9cf1a484bd83f3f1ff4f8f56cae1edfad864f80201f80e81d9ae1c99bf318
-
SSDEEP
1536:kr4vEtHYKKSYP8mxBsEQRn2BkRd4Kp1xtHYKKS8D:kReKKSYh4Eimym2xeKKS8D
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1772 ksoft.exe -
Deletes itself 1 IoCs
pid Process 1984 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\sytre\ksoft.exe 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe File opened for modification C:\Program Files\system\yy.dll ksoft.exe File created C:\Program Files\ty\tem.vbs ksoft.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000002d00c8d6138c740a3f86ef7106dbf9200000000020000000000106600000001000020000000453b823e42570cae267d695160e9127d786c2421af1e91f872ead456ca74c34e000000000e80000000020000200000002d5a5723c46975c2a7c0a230de49442217783209a6d7103c950213e90edf2a4720000000912abdd96f764e12c143847b9a7cb0ca42a775ac8106c73a0666ba2eb78e4637400000006482319be2678c71a1fd1b10eca5b250af4f74f758185fa3f0f1136e153ca97ab4ef84825c7e3c8d6cff96f013d25d675a966879fa60aa2c6ca1b9459d6214f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377550016" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99CA1391-7985-11ED-8C11-42FEA5F7B9B2} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103f856f920dd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000002d00c8d6138c740a3f86ef7106dbf92000000000200000000001066000000010000200000003d6c9c3a0124798dab19802a00762ca28f30b2951a888a450902f79967d02072000000000e800000000200002000000011319dedeb610f7385540a67c8655c0add535a29e87a60b1ea5bc6da30687fe49000000039633d8434d2a4a5266584467527d5fa9c1b02e69522abc63ce6c4cdc8b11ba2e00b4a9e69d1eeb580c76e459849f1be09e4f2e099c6600e5f849bd322e2f7dbc156d1972931c9ae6d2c9d8b4860c11b92472341aa8729f335b08c3c5f9e93fe04fa2cb15aa266945d61fd4ee04a2834740031266af0d7e071b18fa62c898d86c17b6b3f61f9b91077ae6f6f38f37dea4000000089b437a6b7d49af181523e0b02967dc860fd385712407ca0f1c278735ceb3663f34852731962f5cb45c4bb76ad2c19a367c22810a21251b52300ecb2035d2aed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID ksoft.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC} ksoft.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32 ksoft.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 944 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 1772 ksoft.exe 944 iexplore.exe 944 iexplore.exe 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1184 wrote to memory of 1772 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 26 PID 1184 wrote to memory of 1772 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 26 PID 1184 wrote to memory of 1772 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 26 PID 1184 wrote to memory of 1772 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 26 PID 944 wrote to memory of 1816 944 iexplore.exe 29 PID 944 wrote to memory of 1816 944 iexplore.exe 29 PID 944 wrote to memory of 1816 944 iexplore.exe 29 PID 944 wrote to memory of 1816 944 iexplore.exe 29 PID 1184 wrote to memory of 1984 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 31 PID 1184 wrote to memory of 1984 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 31 PID 1184 wrote to memory of 1984 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 31 PID 1184 wrote to memory of 1984 1184 918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe"C:\Users\Admin\AppData\Local\Temp\918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files\sytre\ksoft.exe"C:\Program Files\sytre\ksoft.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\918C7C~1.EXE"2⤵
- Deletes itself
PID:1984
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1816
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD54674566e25e78bb4f4ab7a8a1c86f9cb
SHA1adb83767f85dc9e6270ca934c51bd87203816086
SHA256918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f
SHA5129e5ba5a481f7f4c7671615b1861f077976e76a87467b5fe1a45556b68b2e78265ae9cf1a484bd83f3f1ff4f8f56cae1edfad864f80201f80e81d9ae1c99bf318
-
Filesize
606B
MD59c196688cd0c9cf998898dafa663e4fa
SHA14ec4c543ccb335381840e95af671e3fbef1c1806
SHA2561e83e23394df0f4694b9fbf711d586089f61a8aa48d7d8cc7c95ab8eb1e01791
SHA5124560f965041e27f8b6738c86edf7f9d6e7245c2f762cf1cedb8cf72278c856d8a7b36035e34208f238ec8ebc008d2e5cb7d0d76b325f58dce91c050a52cd27e7
-
Filesize
112KB
MD54674566e25e78bb4f4ab7a8a1c86f9cb
SHA1adb83767f85dc9e6270ca934c51bd87203816086
SHA256918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f
SHA5129e5ba5a481f7f4c7671615b1861f077976e76a87467b5fe1a45556b68b2e78265ae9cf1a484bd83f3f1ff4f8f56cae1edfad864f80201f80e81d9ae1c99bf318
-
Filesize
112KB
MD54674566e25e78bb4f4ab7a8a1c86f9cb
SHA1adb83767f85dc9e6270ca934c51bd87203816086
SHA256918c7c0359cf05bf076302540d40c4131ac09fbbf2d734b6119a4f5cc2397a5f
SHA5129e5ba5a481f7f4c7671615b1861f077976e76a87467b5fe1a45556b68b2e78265ae9cf1a484bd83f3f1ff4f8f56cae1edfad864f80201f80e81d9ae1c99bf318