Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2023, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
WindowsDefenderApplicationGuard.wim
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
WindowsDefenderApplicationGuard.wim
Resource
win10v2004-20230220-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
WindowsDefenderApplicationGuard.wim
-
Size
24.3MB
-
MD5
77fea5dd7c12ebeb6a9d0a3fd0ebdca5
-
SHA1
391f21c9ea7f57e79f2b938bbac0b0e76c21c72b
-
SHA256
f090c6a3a7d0ddc7b567856bab227e6a01ef2078be93cf30e0c2b3f9c56b9451
-
SHA512
aa0d125a253e550e7f5f4ecaea2ef40c21e87fe26c856ad365bb4802f450286de975143c80426708721f627ed41d9ee8226fd47c32b003abfac8dde11183d399
-
SSDEEP
786432:i9A4sTomjSaYetu1dhM9O1wemMCdHJVIexjPAI:i9AbTrjSanG64VmMCdoelPAI
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 2c9ba0669e45d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1C3DAE47-DBBD-11ED-ABF7-5603A1288413} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4058906012" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31027145" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{3E6ED49D-29A3-40D3-8F09-A95659562822}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388349054" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4046248929" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4046248929" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31027145" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31027145" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\wim_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.wim\ = "wim_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\wim_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\.wim OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\wim_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\wim_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\wim_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\wim_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\wim_auto_file\shell\open\CommandId = "IE.File" OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4600 OpenWith.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 1040 iexplore.exe 1040 iexplore.exe 1040 iexplore.exe 1040 iexplore.exe 1040 iexplore.exe 1040 iexplore.exe 1040 iexplore.exe 1040 iexplore.exe 1040 iexplore.exe -
Suspicious use of SetWindowsHookEx 50 IoCs
pid Process 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 3656 OpenWith.exe 1040 iexplore.exe 1040 iexplore.exe 4472 IEXPLORE.EXE 4472 IEXPLORE.EXE 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 4600 OpenWith.exe 1040 iexplore.exe 1040 iexplore.exe 3372 IEXPLORE.EXE 3372 IEXPLORE.EXE 1040 iexplore.exe 1040 iexplore.exe 4212 IEXPLORE.EXE 4212 IEXPLORE.EXE 1040 iexplore.exe 1040 iexplore.exe 4512 IEXPLORE.EXE 4512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3656 wrote to memory of 1040 3656 OpenWith.exe 94 PID 3656 wrote to memory of 1040 3656 OpenWith.exe 94 PID 1040 wrote to memory of 4472 1040 iexplore.exe 96 PID 1040 wrote to memory of 4472 1040 iexplore.exe 96 PID 1040 wrote to memory of 4472 1040 iexplore.exe 96 PID 4600 wrote to memory of 5044 4600 OpenWith.exe 99 PID 4600 wrote to memory of 5044 4600 OpenWith.exe 99 PID 1040 wrote to memory of 3372 1040 iexplore.exe 100 PID 1040 wrote to memory of 3372 1040 iexplore.exe 100 PID 1040 wrote to memory of 3372 1040 iexplore.exe 100 PID 1040 wrote to memory of 1900 1040 iexplore.exe 102 PID 1040 wrote to memory of 1900 1040 iexplore.exe 102 PID 1040 wrote to memory of 4212 1040 iexplore.exe 103 PID 1040 wrote to memory of 4212 1040 iexplore.exe 103 PID 1040 wrote to memory of 4212 1040 iexplore.exe 103 PID 1040 wrote to memory of 2792 1040 iexplore.exe 104 PID 1040 wrote to memory of 2792 1040 iexplore.exe 104 PID 1040 wrote to memory of 4512 1040 iexplore.exe 105 PID 1040 wrote to memory of 4512 1040 iexplore.exe 105 PID 1040 wrote to memory of 4512 1040 iexplore.exe 105 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\WindowsDefenderApplicationGuard.wim1⤵
- Modifies registry class
PID:3180
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\WindowsDefenderApplicationGuard.wim2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4472
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:17414 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3372
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\WindowsDefenderApplicationGuard.wim3⤵
- Modifies Internet Explorer settings
PID:1900
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:82956 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4212
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\WindowsDefenderApplicationGuard.wim3⤵
- Modifies Internet Explorer settings
PID:2792
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:82960 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4512
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\WindowsDefenderApplicationGuard.wim2⤵
- Modifies Internet Explorer settings
PID:5044
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5d92d78557e1e883971d3f17d8b611b38
SHA110918305fca58d5e023f8a73c73c1a5a66c0a07f
SHA2563696799c9e793c52481d7084e47f992f8ab85e64160950b82c203b38f8d0685e
SHA5121719236165e99075f596a00809a83ab758c82894b33bdf8c39d84229aa7f74b8337e455553555ae80900ebf523106ca1aa1816a005f286feaa5dfb58a1955c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5dbe0f49ba8677552ea91871e7e638df8
SHA1354ab068e901e6ca44ec8d2b573aef7276f43a53
SHA256ba5197de2b15d19b5051023427a736f80a499589b68c81b3ca6a59f03005c555
SHA512e065c0b9c05de0259ec7ca8918d5d29992f59aeb414aa93946777e952aec436434b1e4a33021517c6301afc55020cb89e10f1555aab666987f8b36293899ccdb
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
24.3MB
MD577fea5dd7c12ebeb6a9d0a3fd0ebdca5
SHA1391f21c9ea7f57e79f2b938bbac0b0e76c21c72b
SHA256f090c6a3a7d0ddc7b567856bab227e6a01ef2078be93cf30e0c2b3f9c56b9451
SHA512aa0d125a253e550e7f5f4ecaea2ef40c21e87fe26c856ad365bb4802f450286de975143c80426708721f627ed41d9ee8226fd47c32b003abfac8dde11183d399
-
Filesize
24.3MB
MD577fea5dd7c12ebeb6a9d0a3fd0ebdca5
SHA1391f21c9ea7f57e79f2b938bbac0b0e76c21c72b
SHA256f090c6a3a7d0ddc7b567856bab227e6a01ef2078be93cf30e0c2b3f9c56b9451
SHA512aa0d125a253e550e7f5f4ecaea2ef40c21e87fe26c856ad365bb4802f450286de975143c80426708721f627ed41d9ee8226fd47c32b003abfac8dde11183d399