Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
26/08/2023, 16:26
Behavioral task
behavioral1
Sample
apple.exe
Resource
win7-20230712-en
General
-
Target
apple.exe
-
Size
3.3MB
-
MD5
ba268b881bccd2784fe98289eec8ad72
-
SHA1
0c4e7f1473fb7ab22427480c3d784b6e0e404956
-
SHA256
c83921c8dda800ef24ebe873ec175617110dc9deb2629d1107f219ca30caece3
-
SHA512
30c836bb91ef96f5952571bba27d08c32011e619890fae392f882e5c7db7558ed26e6aa1fbdc2ce7d22c0a6aebc580e17ae807de70d99945cb2b438bd8cbbb3b
-
SSDEEP
49152:98jzvhuGMsOTenal2tV594MzhJD3TMgwQiPRxksa2EQUFO0JIbn6/ubWYY725hXQ:9QFXlbnal2XDhZRwRVsE0JDoWYJPXLk
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 880 netsh.exe -
resource yara_rule behavioral1/memory/2616-0-0x000000013FBE0000-0x0000000140503000-memory.dmp themida behavioral1/memory/2616-2-0x000000013FBE0000-0x0000000140503000-memory.dmp themida behavioral1/memory/2616-3-0x000000013FBE0000-0x0000000140503000-memory.dmp themida behavioral1/memory/2616-4-0x000000013FBE0000-0x0000000140503000-memory.dmp themida behavioral1/memory/2616-5-0x000000013FBE0000-0x0000000140503000-memory.dmp themida behavioral1/memory/2616-6-0x000000013FBE0000-0x0000000140503000-memory.dmp themida behavioral1/memory/2616-27-0x000000013FBE0000-0x0000000140503000-memory.dmp themida behavioral1/memory/2616-28-0x000000013FBE0000-0x0000000140503000-memory.dmp themida -
Drops desktop.ini file(s) 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini apple.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\WJ8HJG09\desktop.ini apple.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini apple.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\20BGZFMZ\desktop.ini apple.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BSTASY24\desktop.ini apple.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\COWGNRUO\desktop.ini apple.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2616 apple.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
pid Process 2420 ipconfig.exe 1944 ipconfig.exe 2480 ipconfig.exe -
Kills process with taskkill 3 IoCs
pid Process 2168 taskkill.exe 2804 taskkill.exe 2916 taskkill.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52955701-442D-11EE-BA9B-CEC9BBFEAAA3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2616 apple.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2168 taskkill.exe Token: SeDebugPrivilege 2804 taskkill.exe Token: SeDebugPrivilege 2916 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2612 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2612 iexplore.exe 2612 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 2616 wrote to memory of 808 2616 apple.exe 29 PID 2616 wrote to memory of 808 2616 apple.exe 29 PID 2616 wrote to memory of 808 2616 apple.exe 29 PID 808 wrote to memory of 2168 808 cmd.exe 30 PID 808 wrote to memory of 2168 808 cmd.exe 30 PID 808 wrote to memory of 2168 808 cmd.exe 30 PID 2616 wrote to memory of 2536 2616 apple.exe 32 PID 2616 wrote to memory of 2536 2616 apple.exe 32 PID 2616 wrote to memory of 2536 2616 apple.exe 32 PID 2536 wrote to memory of 2804 2536 cmd.exe 33 PID 2536 wrote to memory of 2804 2536 cmd.exe 33 PID 2536 wrote to memory of 2804 2536 cmd.exe 33 PID 2616 wrote to memory of 2888 2616 apple.exe 34 PID 2616 wrote to memory of 2888 2616 apple.exe 34 PID 2616 wrote to memory of 2888 2616 apple.exe 34 PID 2888 wrote to memory of 2916 2888 cmd.exe 35 PID 2888 wrote to memory of 2916 2888 cmd.exe 35 PID 2888 wrote to memory of 2916 2888 cmd.exe 35 PID 2616 wrote to memory of 2948 2616 apple.exe 36 PID 2616 wrote to memory of 2948 2616 apple.exe 36 PID 2616 wrote to memory of 2948 2616 apple.exe 36 PID 2948 wrote to memory of 2612 2948 cmd.exe 37 PID 2948 wrote to memory of 2612 2948 cmd.exe 37 PID 2948 wrote to memory of 2612 2948 cmd.exe 37 PID 2612 wrote to memory of 2176 2612 iexplore.exe 39 PID 2612 wrote to memory of 2176 2612 iexplore.exe 39 PID 2612 wrote to memory of 2176 2612 iexplore.exe 39 PID 2612 wrote to memory of 2176 2612 iexplore.exe 39 PID 2616 wrote to memory of 2676 2616 apple.exe 40 PID 2616 wrote to memory of 2676 2616 apple.exe 40 PID 2616 wrote to memory of 2676 2616 apple.exe 40 PID 2616 wrote to memory of 2016 2616 apple.exe 42 PID 2616 wrote to memory of 2016 2616 apple.exe 42 PID 2616 wrote to memory of 2016 2616 apple.exe 42 PID 2616 wrote to memory of 1896 2616 apple.exe 43 PID 2616 wrote to memory of 1896 2616 apple.exe 43 PID 2616 wrote to memory of 1896 2616 apple.exe 43 PID 1896 wrote to memory of 1548 1896 cmd.exe 44 PID 1896 wrote to memory of 1548 1896 cmd.exe 44 PID 1896 wrote to memory of 1548 1896 cmd.exe 44 PID 2616 wrote to memory of 796 2616 apple.exe 45 PID 2616 wrote to memory of 796 2616 apple.exe 45 PID 2616 wrote to memory of 796 2616 apple.exe 45 PID 796 wrote to memory of 1632 796 cmd.exe 46 PID 796 wrote to memory of 1632 796 cmd.exe 46 PID 796 wrote to memory of 1632 796 cmd.exe 46 PID 2616 wrote to memory of 2988 2616 apple.exe 49 PID 2616 wrote to memory of 2988 2616 apple.exe 49 PID 2616 wrote to memory of 2988 2616 apple.exe 49 PID 2988 wrote to memory of 880 2988 cmd.exe 50 PID 2988 wrote to memory of 880 2988 cmd.exe 50 PID 2988 wrote to memory of 880 2988 cmd.exe 50 PID 2616 wrote to memory of 1276 2616 apple.exe 51 PID 2616 wrote to memory of 1276 2616 apple.exe 51 PID 2616 wrote to memory of 1276 2616 apple.exe 51 PID 1276 wrote to memory of 1140 1276 cmd.exe 52 PID 1276 wrote to memory of 1140 1276 cmd.exe 52 PID 1276 wrote to memory of 1140 1276 cmd.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\apple.exe"C:\Users\Admin\AppData\Local\Temp\apple.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\system32\taskkill.exetaskkill /f /im EpicGamesLauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\system32\taskkill.exetaskkill /f /im Battle.net.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start https://applecheats.cc2⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://applecheats.cc/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2612 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:2676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NETSH WINSOCK RESET >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\netsh.exeNETSH WINSOCK RESET3⤵PID:1548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NETSH INT IP RESET >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\system32\netsh.exeNETSH INT IP RESET3⤵PID:1632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall reset >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\netsh.exenetsh advfirewall reset3⤵
- Modifies Windows Firewall
PID:880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV4 RESET >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\system32\netsh.exeNETSH INTERFACE IPV4 RESET3⤵PID:1140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NETSH INTERFACE IPV6 RESET >nul 2>&12⤵PID:2396
-
C:\Windows\system32\netsh.exeNETSH INTERFACE IPV6 RESET3⤵PID:904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NETSH INTERFACE TCP RESET >nul 2>&12⤵PID:1828
-
C:\Windows\system32\netsh.exeNETSH INTERFACE TCP RESET3⤵PID:2456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NETSH INT RESET ALL >nul 2>&12⤵PID:844
-
C:\Windows\system32\netsh.exeNETSH INT RESET ALL3⤵PID:2120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&12⤵PID:1088
-
C:\Windows\system32\ipconfig.exeIPCONFIG /RELEASE3⤵
- Gathers network information
PID:1944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c IPCONFIG /RELEASE >nul 2>&12⤵PID:2516
-
C:\Windows\system32\ipconfig.exeIPCONFIG /RELEASE3⤵
- Gathers network information
PID:2480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c IPCONFIG /FLUSHDNS >nul 2>&12⤵PID:2488
-
C:\Windows\system32\ipconfig.exeIPCONFIG /FLUSHDNS3⤵
- Gathers network information
PID:2420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NBTSTAT -R >nul 2>&12⤵PID:1248
-
C:\Windows\system32\nbtstat.exeNBTSTAT -R3⤵PID:1844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c NBTSTAT -RR >nul 2>&12⤵PID:3012
-
C:\Windows\system32\nbtstat.exeNBTSTAT -RR3⤵PID:1344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c arp -a >nul 2>&12⤵PID:2800
-
C:\Windows\system32\ARP.EXEarp -a3⤵PID:1540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c arp -d >nul 2>&12⤵PID:1740
-
C:\Windows\system32\ARP.EXEarp -d3⤵PID:472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c WMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE >nul 2>&12⤵PID:892
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PATH WIN32_NETWORKADAPTER WHERE PHYSICALADAPTER=TRUE CALL DISABLE3⤵PID:600
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf