Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2022, 03:46
Static task
static1
Behavioral task
behavioral1
Sample
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
Resource
win10v2004-20221111-en
General
-
Target
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe
-
Size
148KB
-
MD5
288890e2c2890392a3c6db6ab9c7c54b
-
SHA1
7816b571ada479c1df364b6db6fc566b81e36d89
-
SHA256
cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb
-
SHA512
93cff4a2b66c8ce9f7404892e9ffea29423dda6648b23d5974df986f2bd3bc5b545c65028e20fda3bc376b3e322caa549b4aeaf96272237e9a25d91d1c9f6e7d
-
SSDEEP
3072:fPNIIS1JrpdvQD8CbCF/Fp2zrcNmSZNMBeRZ9aZUXcX:fW5tdvhCbCFtp2zrTSzMKZ9JXcX
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1268 set thread context of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31002027" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4028574879" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31002027" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{13CD6E31-799F-11ED-919F-42A3CC74B480} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31002027" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4028574879" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31002027" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4052971104" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4052971104" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe Token: SeDebugPrivilege 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe Token: SeDebugPrivilege 2084 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1852 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 1852 IEXPLORE.EXE 1852 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1268 wrote to memory of 1636 1268 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 83 PID 1636 wrote to memory of 4188 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 85 PID 1636 wrote to memory of 4188 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 85 PID 1636 wrote to memory of 4188 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 85 PID 4188 wrote to memory of 1852 4188 iexplore.exe 86 PID 4188 wrote to memory of 1852 4188 iexplore.exe 86 PID 1852 wrote to memory of 2084 1852 IEXPLORE.EXE 87 PID 1852 wrote to memory of 2084 1852 IEXPLORE.EXE 87 PID 1852 wrote to memory of 2084 1852 IEXPLORE.EXE 87 PID 1636 wrote to memory of 2084 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 87 PID 1636 wrote to memory of 2084 1636 cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"C:\Users\Admin\AppData\Local\Temp\cc8c028665e512fea4c00a6e1acca4f16bf9867bbbc12eafaab33b178e4121bb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2084
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD57e145496e26bad88f2e9ac990b743c01
SHA157b9be66121d46af3fd063bc14f75f8545ea3992
SHA25669d1f2f9dbdfa75dd0cd9c482609c9d0bae3de5432b7ada8998588830a534da5
SHA512128958b60d53aedb2f4d764b18ccc8f0ea2436ec384262b1d97dc5a940909e3e1a5bd29b9e4609dbda5057a8e5292655c786e3b8f0dff4d446f5cd987b87434f