Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
Resource
win10v2004-20221111-en
General
-
Target
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
-
Size
148KB
-
MD5
288890e2c2890392a3c6db6ab9c7c54b
-
SHA1
7816b571ada479c1df364b6db6fc566b81e36d89
-
SHA256
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb
-
SHA512
93cff4a2b66c8ce9f7404892e9ffea29423dda6648b23d5974df986f2bd3bc5b545c65028e20fda3bc376b3e322caa549b4aeaf96272237e9a25d91d1c9f6e7d
-
SSDEEP
3072:fPNIIS1JrpdvQD8CbCF/Fp2zrcNmSZNMBeRZ9aZUXcX:fW5tdvhCbCFtp2zrTSzMKZ9JXcX
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1268 iexplore.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uzfjfd = "C:\\Users\\Admin\\AppData\\Roaming\\Uzfjfd.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1780 set thread context of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05404360-799F-11ED-882A-F263091D6DCE} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377560917" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe Token: SeDebugPrivilege 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe Token: SeDebugPrivilege 1268 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1696 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 1696 IEXPLORE.EXE 1696 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE 1752 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1780 wrote to memory of 1320 1780 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 28 PID 1320 wrote to memory of 1268 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 29 PID 1320 wrote to memory of 1268 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 29 PID 1320 wrote to memory of 1268 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 29 PID 1320 wrote to memory of 1268 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 29 PID 1320 wrote to memory of 1268 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 29 PID 1320 wrote to memory of 1268 1320 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 29 PID 1268 wrote to memory of 1696 1268 iexplore.exe 30 PID 1268 wrote to memory of 1696 1268 iexplore.exe 30 PID 1268 wrote to memory of 1696 1268 iexplore.exe 30 PID 1268 wrote to memory of 1696 1268 iexplore.exe 30 PID 1696 wrote to memory of 1752 1696 IEXPLORE.EXE 33 PID 1696 wrote to memory of 1752 1696 IEXPLORE.EXE 33 PID 1696 wrote to memory of 1752 1696 IEXPLORE.EXE 33 PID 1696 wrote to memory of 1752 1696 IEXPLORE.EXE 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
601B
MD5fb096588b6ffc5b639266f91a0b609fc
SHA1f7ebaf98b1bbdbf23b41ea4327555f5e79b02849
SHA256153a9fcfe8269a0b93cbddafddd58ab4700da4f8bfd60fd81b03fa6c473f63dc
SHA51244b64218d0d3d8dacaa8c5a6173c3e435dabca90a6c07228aa6d818feb5b96f2c19af65667eb8f78264a5efd442b20d19cfed841d327fb8203c57116300e1b66