Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20/07/2023, 08:46
Behavioral task
behavioral1
Sample
Aws2.2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Aws2.2.exe
Resource
win10v2004-20230703-en
General
-
Target
Aws2.2.exe
-
Size
696KB
-
MD5
54c63e845b75fd07f48739e5d2487ca1
-
SHA1
e0a8c295ea69905c83aec0603ac0bccc9fb981a3
-
SHA256
d11fa3c76f2c301bd3c2dc33c7736e6c0ed46e989d7ef76369823c33ec0f7496
-
SHA512
3f671c41c112ad7b0b4011a7dafd102de8912f1d81c8bc4e21a5ae7de560f6fdb0bb2a770647b7e60c8e082989a8d60ca00cfd00eeabe9091908ba47e86713b9
-
SSDEEP
12288:fXMhkFCmmrYcJ5wc68dgeSpAp10BWEhQaV+aGEcC7tC5bT9kZetKg3dBdHDit1w0:EyFCmJcTwb8xXAWEqlaGB0yTcgKg3dBI
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\y: Aws2.2.exe File opened (read-only) \??\b: Aws2.2.exe File opened (read-only) \??\t: Aws2.2.exe File opened (read-only) \??\m: Aws2.2.exe File opened (read-only) \??\n: Aws2.2.exe File opened (read-only) \??\r: Aws2.2.exe File opened (read-only) \??\x: Aws2.2.exe File opened (read-only) \??\z: Aws2.2.exe File opened (read-only) \??\g: Aws2.2.exe File opened (read-only) \??\l: Aws2.2.exe File opened (read-only) \??\h: Aws2.2.exe File opened (read-only) \??\i: Aws2.2.exe File opened (read-only) \??\j: Aws2.2.exe File opened (read-only) \??\k: Aws2.2.exe File opened (read-only) \??\p: Aws2.2.exe File opened (read-only) \??\s: Aws2.2.exe File opened (read-only) \??\a: Aws2.2.exe File opened (read-only) \??\e: Aws2.2.exe File opened (read-only) \??\v: Aws2.2.exe File opened (read-only) \??\w: Aws2.2.exe File opened (read-only) \??\u: Aws2.2.exe File opened (read-only) \??\o: Aws2.2.exe File opened (read-only) \??\q: Aws2.2.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Aws2.2.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Aws.ini Aws2.2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F359AFE1-26D9-11EE-A581-724B81B1CE5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396607779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dc65d4e6bad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7eaec47cb7afa4887efc5e3f3ae1d8c000000000200000000001066000000010000200000007ae7f4d27669630fd125e37dedbdae3bf7ba2dc3e2700071b23ca103caee8089000000000e8000000002000020000000757df446ad6fc33395d2baf2e69f7bfcb4aff3c9d12e074d78829e596fd03a73200000007bc2cc5bcd15fa0f9d1d46f3d364757d523b2f8ec66eea0ce82dcca6e4c4a40a4000000094fd52c61e5e6ebc037f3e7de7ed196da63b706b0e54a7e80fdfbfb60e8531a161a63e1747fe4754f1533c6f1db31058c9ee4d12d84da554c78b580e5a41d57f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7eaec47cb7afa4887efc5e3f3ae1d8c00000000020000000000106600000001000020000000b39febbfe00995c3a3311e806169146c6f7981e265c76952d6b1f754486f0896000000000e8000000002000020000000a3c4e6553537b6658610e6c676e6ba9598598e09c804706ae6f9328685658d4f90000000634c61cee898f07e9d42a33100377cb62d9356e8d6dcf3bec1fa6110cf7ea5d304e3e44a5f661f92a6805b91b3d182f6d88e215b5c76ffdb3a563a0dde9b16a79412d7b98cf5f8c3e00232ae07dc14e1df2db6f8df85e12e9f885a39566efeaa4ff706e65156908dc442fa5b235f87c1a0d044bb8ee52f6cb64e77dcd958170e55316df9f1a980f79823b10eacea960d4000000096be08758e96b4915444433844d84ece0dc71ea60da5bdb56cf8d6efc1575dfa625a2d0515b071dd047689af530c42a6b9fb5aeabe54e8715aa35cf72c998c93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 936 Aws2.2.exe 936 Aws2.2.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 936 Aws2.2.exe 2340 iexplore.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 936 Aws2.2.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 936 Aws2.2.exe 936 Aws2.2.exe 936 Aws2.2.exe 936 Aws2.2.exe 936 Aws2.2.exe 936 Aws2.2.exe 936 Aws2.2.exe 2340 iexplore.exe 2340 iexplore.exe 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE 2836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 936 wrote to memory of 2340 936 Aws2.2.exe 30 PID 936 wrote to memory of 2340 936 Aws2.2.exe 30 PID 936 wrote to memory of 2340 936 Aws2.2.exe 30 PID 936 wrote to memory of 2340 936 Aws2.2.exe 30 PID 2340 wrote to memory of 2836 2340 iexplore.exe 32 PID 2340 wrote to memory of 2836 2340 iexplore.exe 32 PID 2340 wrote to memory of 2836 2340 iexplore.exe 32 PID 2340 wrote to memory of 2836 2340 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aws2.2.exe"C:\Users\Admin\AppData\Local\Temp\Aws2.2.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe" Http://10.127.0.162:80/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2836
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD598b4411190640145144749dfe98c277d
SHA10522f04146c8bfc0b5577900c56621d451069e37
SHA256e4682574bcf819a2c6117db1a3f1d6f96e8eb623986da03fbc193c572fe5c79d
SHA51245af15042d173e3561be6577d0576ac98acd26ef899f9a90ffbe5118bec64c915b2ab82d3c9c8b4ffe59a320fdd7545d0aec287e7b9c5bdc41840ed87ed91dd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5410d1543a9280b01e6922342a6c9fe22
SHA1e0a77aa20eb84f4477b4493ba07007110fc93ca1
SHA256cf4039f17f102abc27845743ce026712e8afb44382f94455205f853aa2a366c6
SHA512e0752a751f837a495371d0d67f076c988c8f8ecc7406822abb8b0322eb42b03aae02455f1721cc4a5e5d7b47983fc07f4f9b47b594d86bb42d4839490d0786c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56269e7177e776f6a1d50a2bbef6ff3c5
SHA1117a98d0089ecd09587fee34fd441482e69048cb
SHA25639ba7ae7bb2bf324267dae3d3073061a14d4eac62857f7c966af8477ac25054c
SHA512ca2d6fd2e6bacdc1c438058cf9dd5d732934b55ea6497c035ceb30848e2ff43cb812104736553c5cb64ed55f06c7f98aa59c845d1e6cafbd6af60fac7de03cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52b190a467b22aea19efba3c0a62b9bf7
SHA1377251bdb5eb04db2598ba41682db74d784dbb06
SHA256392738b3c66e7fee1bed16a5b91e317b84156e2bfad503f93457e9e3ab9179b0
SHA51297339c91da125032f35e5dfd926408ecdfc36b46b1c9a1e88b712aa989b81646cd7720213f7a35653e995a97f0d3b0f21601877b07fb766fdb606d7dc8311681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD570fee9bbed3585b241c5f56779dbc9ac
SHA190a0b823c09af49af4aa1ddfdc1afd6432882b11
SHA25689ed25b360ee890a25495c211d22a2838c04ebbcebb26ddf900d28c276d82297
SHA5129afb0ce5fdc7a21f2dc945f263db4ae3015fe3956f90eba6e590be06b18e571c23e63a8c3aede655b145f6ed170ba5bd6dfb02e5de3729c636d79ad620ca7193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51454c91498ed920954e76d7ba59dc698
SHA16b8d60ef0c01df6751d9d88019437f0158556c11
SHA2564dab453aad88304b721f907abc42bb23de8f17d2cbd73d12fbea876574b40894
SHA512417127c60585f4e69814382fb2a5f65cde49640344bf3b4094e63ce1e3e0472e5d2f5c15f7e33b3c5712e0e59ea4a9d9e5ed368c567eda326dcbfeb8c0d27040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52f04bc3f36b2b49689d47d6b746e85af
SHA121a1de8412b16d4c051d89cf6299e9def1d2a71a
SHA256755d0cd4423390c9cb3e258b06a6718220b0b457746698009115e2f1f44e6056
SHA51256ac871bd17bc4bfe13298f065114124f3c71be2a85601a2ef5818ef492866eefe0f7d31194c2d0f05497aae585c0041d8cb62df4379ce52a7cb140ccc0b4c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58e5117b83b994da8b86d443dac66266a
SHA12654ab7ad43630de79c5c3512763fd29647f240f
SHA256bba64cffc836d9f257bd01f734911832fcacc12dc8607441f08c4483bf7be6ec
SHA5123290af8e4050908cfa9cf5e395f4cd5499994abd229da450f18f22a6c825b07e5ca9e29dc08ada4d5cecaabbb6e09de10dc73f93887130a5b9ac734b11c88eec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bb655a58277bcbe239aeba77f5ce0563
SHA16ecc92b87fabee76d785f3ae7fb74ec7e008c1f9
SHA256522f7c19f416d163f4941e1ce2af42402d080aba6d28b1a97c8bfded4a78a0a1
SHA5129463ce7e926022384a4b16dbca6ccf551aea1fca613602ae292511f6143f85a4ec6edf68bffc96512ac1c2dd9f133e09578a3e8dbb8c8cb8db4609a34031f0df
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AJTUMOT\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
606B
MD55ba578f677282b5d93b90162b18a2aca
SHA140fa7833bdbd584ee3649c043d3ddfba4af7fd55
SHA256fe6e9cad260da2936d9ac59032f07f21a230fe45f37d3ea26bfad35cac716abe
SHA512c22e3d3834c00ea8dad8dda148160a572934d2c8e2c9efe77f3e1146e9e97506f5108021c63053e5796eb2a9f7b1810117f2a22b2c6adb49ca251ea9c9898b3d
-
Filesize
47B
MD5f1dba6a1b1ccbaa77dfbaa1c82070f01
SHA1e0d7bcee9f3873ce18eb921983fe36991b9a76c8
SHA256c39a916801c2260d283464a5bed63476afc643f7c832d6b93f542cf67b42a48e
SHA512a8a4c771a669e95ac3fc521f0b1052c9ce67724072301dbb4dc3cd4eec88d1e77c6e5d4ca8356a540a77c66ea149ece1644673a51a9838d4c66d0d8ef4bf580a