Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/12/2022, 22:15
221228-16b2vsbg53 828/12/2022, 22:14
221228-155yjsbg49 628/12/2022, 22:11
221228-14aq1sbg46 8Analysis
-
max time kernel
106s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/12/2022, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
Xbox Achievement Unlocker 1.4.1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Xbox Achievement Unlocker 1.4.1.exe
Resource
win10v2004-20221111-en
General
-
Target
Xbox Achievement Unlocker 1.4.1.exe
-
Size
2.2MB
-
MD5
b31e4faa516447ada1d619b228bba545
-
SHA1
1ae515c22cf51f10dce259c69456788bd3c64ca7
-
SHA256
e6555cb6c0d1fe378fcbded709d1b4bd063fdb6a5c130b2572c00893a130ebd9
-
SHA512
1ff2921966137b3c9ace78eb1ca2b26d05e22827d9f39ceb9f5b02c38490e9acf5faf91c80a76e7afac65dcaf3bc69dedae66bf240f5c0a29c471b2a8d59104d
-
SSDEEP
24576:KXpb1zoC9C8jG254xWLIxJULeHA62LASkG4ZjPSduVNTpm7PppZy6o3qB7jW5JMc:KjsC9CMU6AA6PvAo3qB7jRtBohaK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "379030689" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A80D4E1-86FD-11ED-9FD0-D6EA6736E294} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000568bab6cc1978a4b8be5250ed1dd475800000000020000000000106600000001000020000000e419745b628975381798c1dd65a7230f896610e914745aa12ef2ddbd0ad5b2dc000000000e8000000002000020000000ca219977b673c2fd59f7fa7b1d48e63c35b5e3827939798c8a0565ea78e10d4890000000cd504872208e214f568365ddf236199a294012f257534e8ff12adc387ccb72f41600893e0acd837b160a5a951c4b95964550f65898aa01099cb9482285a2ee8122448ecbcb57f8f05045ffc68e5df669824dc9ea4dc56cbc02856eeae3f6b35a4b1f8b99ed157d337f52a3ac300c7223b98e7d623a2820ddd31bc642da4d806ed6bdb716415a04bd4b2e6157a050432940000000ffc119e2e139e05414701bc78d09b438c237810f36ce100303590381815f5f821bcfb8af8e033b5d88f33802b3efccf5a0e57fd46f9b66d6cd13ae7a9816e5cd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0480df3091bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000568bab6cc1978a4b8be5250ed1dd47580000000002000000000010660000000100002000000010db26c8925e8aea189c4be8de4db66b8e52b9e17f339bbe122b6014ec9c1f45000000000e80000000020000200000003bddcec53e50fba92bb774f48ab3dbacc01bf8f8bdc0d5b0b00ae85ee61757b820000000e9a7decf8d0fbb52987a08110b11629ffd99e0fec37f3fb502031b34a93cc43140000000df385543cb890d759f2fcc0377074bf8b48637a5f1e20614b2a06be7d7a0b7d959f4e70cd26dcaf51d46d98db661c6892f03355add8da074e3c940056e64ceab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 268 iexplore.exe 268 iexplore.exe 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE 1224 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1200 wrote to memory of 268 1200 Xbox Achievement Unlocker 1.4.1.exe 27 PID 1200 wrote to memory of 268 1200 Xbox Achievement Unlocker 1.4.1.exe 27 PID 1200 wrote to memory of 268 1200 Xbox Achievement Unlocker 1.4.1.exe 27 PID 268 wrote to memory of 1224 268 iexplore.exe 29 PID 268 wrote to memory of 1224 268 iexplore.exe 29 PID 268 wrote to memory of 1224 268 iexplore.exe 29 PID 268 wrote to memory of 1224 268 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xbox Achievement Unlocker 1.4.1.exe"C:\Users\Admin\AppData\Local\Temp\Xbox Achievement Unlocker 1.4.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=6.0.8&gui=true2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:268 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1224
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd60e5aa212401b378637ecc742a48a5
SHA170e2d77614dee27b9935fd74be1e72f129d22cb4
SHA256581a15f935e84c4088172a04d461213d30b839688953428b6804bdb8aee676b2
SHA51212e9b97657ad7af21db13eb9779d5cdd0f3667f602888cd385914f6fb84d3f1e39b898d6d198b7b3bc5312367b9d9c921381cba34e2e27266614021489efebd5
-
Filesize
598B
MD516510c8fbb36b573aec2954230ae1ced
SHA13bf9cc1d7b0d28641b49886aa0894a54e685a6f9
SHA256d501e046e9805de89bef7775676fdd13fbaf9d0c6dfb2f178c7303cd99bd3d6b
SHA51250c044035725e58cf4deace7297a8a9aa36508088d1c9cc3dfc2d037d860614a069e1130b6aa46e8258922035d0ae583e5ac1498c194446ab23c75f83f967e3d