Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 14:34
Behavioral task
behavioral1
Sample
f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe
Resource
win10v2004-20230831-en
General
-
Target
f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe
-
Size
280KB
-
MD5
61d5af8062275bfd4213106f731437d2
-
SHA1
777b0c4202ae6a7c72129204d69963407c178094
-
SHA256
f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10
-
SHA512
077f441d30b23e91c3d3c886ea6b506986f6608dcfbec26416908f6ef2a3fa22ea85ebdf7bdd26901fae89341d2a870c34029ee069568b5b60bce288ea94e36b
-
SSDEEP
6144:yXSQ8BCMis1TMrRQwy7eIeCDbFcEOkCybEaQRXr9HNdvOa:yXv8BCLocRZy7eIeyb1Okx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\RcUcjIKs.sys mpnotify.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Control Panel\International\Geo\Nation f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe -
Executes dropped EXE 2 IoCs
pid Process 3104 955be6e3 2332 mpnotify.exe -
resource yara_rule behavioral2/memory/1188-0-0x0000000000740000-0x00000000007CE000-memory.dmp upx behavioral2/files/0x000c0000000231cb-2.dat upx behavioral2/files/0x000c0000000231cb-4.dat upx behavioral2/memory/3104-3-0x0000000000040000-0x00000000000CE000-memory.dmp upx behavioral2/memory/1188-6-0x0000000000740000-0x00000000007CE000-memory.dmp upx behavioral2/memory/3104-19-0x0000000000040000-0x00000000000CE000-memory.dmp upx behavioral2/memory/1188-33-0x0000000000740000-0x00000000007CE000-memory.dmp upx behavioral2/memory/3104-40-0x0000000000040000-0x00000000000CE000-memory.dmp upx behavioral2/memory/3104-46-0x0000000000040000-0x00000000000CE000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 -
Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4 955be6e3 File created C:\Windows\SysWOW64\955be6e3 f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A 955be6e3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4 955be6e3 File created C:\Windows\system32\ \Windows\System32\1BjRL1UdL.sys mpnotify.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\7G49jfhCS.sys mpnotify.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 mpnotify.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 mpnotify.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName mpnotify.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 1616 timeout.exe 2176 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\Software\Microsoft\Internet Explorer\New Windows\Allow mpnotify.exe Set value (data) \REGISTRY\USER\S-1-5-21-1980726966-773384374-2129981223-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.hao774.com mpnotify.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 955be6e3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 955be6e3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 955be6e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 955be6e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 955be6e3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 955be6e3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 955be6e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 955be6e3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 955be6e3 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3104 955be6e3 3104 955be6e3 3104 955be6e3 3104 955be6e3 3104 955be6e3 3104 955be6e3 3104 955be6e3 3104 955be6e3 3104 955be6e3 3104 955be6e3 3116 Explorer.EXE 3116 Explorer.EXE 3116 Explorer.EXE 3116 Explorer.EXE 3104 955be6e3 3104 955be6e3 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3116 Explorer.EXE -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 1188 f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe Token: SeTcbPrivilege 1188 f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe Token: SeDebugPrivilege 3104 955be6e3 Token: SeTcbPrivilege 3104 955be6e3 Token: SeDebugPrivilege 3104 955be6e3 Token: SeDebugPrivilege 3116 Explorer.EXE Token: SeDebugPrivilege 3116 Explorer.EXE Token: SeIncBasePriorityPrivilege 1188 f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe Token: SeDebugPrivilege 3104 955be6e3 Token: SeDebugPrivilege 2332 mpnotify.exe Token: SeDebugPrivilege 2332 mpnotify.exe Token: SeDebugPrivilege 2332 mpnotify.exe Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeIncBasePriorityPrivilege 3104 955be6e3 Token: SeDebugPrivilege 2332 mpnotify.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe 2332 mpnotify.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2332 mpnotify.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3104 wrote to memory of 3116 3104 955be6e3 19 PID 3104 wrote to memory of 3116 3104 955be6e3 19 PID 3104 wrote to memory of 3116 3104 955be6e3 19 PID 3104 wrote to memory of 3116 3104 955be6e3 19 PID 3104 wrote to memory of 3116 3104 955be6e3 19 PID 3116 wrote to memory of 2332 3116 Explorer.EXE 90 PID 3116 wrote to memory of 2332 3116 Explorer.EXE 90 PID 3116 wrote to memory of 2332 3116 Explorer.EXE 90 PID 3116 wrote to memory of 2332 3116 Explorer.EXE 90 PID 3116 wrote to memory of 2332 3116 Explorer.EXE 90 PID 3116 wrote to memory of 2332 3116 Explorer.EXE 90 PID 3116 wrote to memory of 2332 3116 Explorer.EXE 90 PID 3104 wrote to memory of 624 3104 955be6e3 3 PID 3104 wrote to memory of 624 3104 955be6e3 3 PID 3104 wrote to memory of 624 3104 955be6e3 3 PID 3104 wrote to memory of 624 3104 955be6e3 3 PID 3104 wrote to memory of 624 3104 955be6e3 3 PID 1188 wrote to memory of 4440 1188 f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe 91 PID 1188 wrote to memory of 4440 1188 f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe 91 PID 1188 wrote to memory of 4440 1188 f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe 91 PID 4440 wrote to memory of 2176 4440 cmd.exe 93 PID 4440 wrote to memory of 2176 4440 cmd.exe 93 PID 4440 wrote to memory of 2176 4440 cmd.exe 93 PID 3104 wrote to memory of 4040 3104 955be6e3 94 PID 3104 wrote to memory of 4040 3104 955be6e3 94 PID 3104 wrote to memory of 4040 3104 955be6e3 94 PID 4040 wrote to memory of 1616 4040 cmd.exe 96 PID 4040 wrote to memory of 1616 4040 cmd.exe 96 PID 4040 wrote to memory of 1616 4040 cmd.exe 96 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19 PID 2332 wrote to memory of 3116 2332 mpnotify.exe 19
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:624
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe"C:\Users\Admin\AppData\Local\Temp\f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:2176
-
-
-
-
C:\ProgramData\Microsoft\mpnotify.exe"C:\ProgramData\Microsoft\mpnotify.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
-
-
C:\Windows\Syswow64\955be6e3C:\Windows\Syswow64\955be6e31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\955be6e3"2⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\timeout.exetimeout /t 13⤵
- Delays execution with timeout.exe
PID:1616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD58f9739e266623499391cbac652a01036
SHA1da16142d698dbbd243930e5058d7756f2204296d
SHA25633f636f222a3af0bbbe429cc87b25b21b6c56182936c81c9453c4bdfb61a3c5e
SHA512d5e562332b4bcd77c7c4c426491e37d3501388656e51f600fb6f007a59675d3ad5669487e730a38af705e94e2746f1bd9238190fe1c6152229096a5180aa3797
-
Filesize
280KB
MD5997740488eb4f875a6696ac96520302b
SHA1d409e698e370c58e765829672bcfa3d8ec64e486
SHA2565608f96513eec84923dce8dc0a046a659a20a6a4b32dacd51a92eaeb4a58078b
SHA512620064c55ac50848ff94bbaf6a0216b6bacfa26fd8f0656dffbd36532cbde3258ce88cda9a305307d283fdd9d449f0db6f51c89724ddaa69040a56cbe4ee2fb1
-
Filesize
280KB
MD5997740488eb4f875a6696ac96520302b
SHA1d409e698e370c58e765829672bcfa3d8ec64e486
SHA2565608f96513eec84923dce8dc0a046a659a20a6a4b32dacd51a92eaeb4a58078b
SHA512620064c55ac50848ff94bbaf6a0216b6bacfa26fd8f0656dffbd36532cbde3258ce88cda9a305307d283fdd9d449f0db6f51c89724ddaa69040a56cbe4ee2fb1