Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10013e80dc8e...a8.exe
windows7-x64
7040677c072...cc.exe
windows7-x64
30ba3a15c5f...6a.exe
windows7-x64
1019d029dd80...b2.dll
windows7-x64
101ac4f94c2d...83.exe
windows7-x64
71efeb07862...bb.dll
windows7-x64
327861dacdd...03.exe
windows7-x64
1031860041f6...ff.exe
windows7-x64
33c49ffd8bf...86.dll
windows7-x64
141edb742c1...45.exe
windows7-x64
64ad4c837ce...e1.exe
windows7-x64
150682871a2...53.exe
windows7-x64
65f3bfe76bb...b6.exe
windows7-x64
784f3902fd...12.exe
windows7-x64
10816c0e4deb...6c.exe
windows7-x64
781b49d3c61...a9.exe
windows7-x64
1082d1e979d2...67.exe
windows7-x64
78ba3f20419...4f.exe
windows7-x64
108d8576432c...fe.exe
windows7-x64
5962bbb1929...e2.exe
windows7-x64
1096f295d08c...d1.exe
windows7-x64
796f2bcea04...28.exe
windows7-x64
109972304b5c...64.exe
windows7-x64
109ff988d7ea...09.exe
windows7-x64
7bfddb59433...b0.exe
windows7-x64
3c0ca77690a...a5.dll
windows7-x64
1cb0f8c9180...69.exe
windows7-x64
10cfbcc54f36...29.exe
windows7-x64
7dd0f55e997...a3.exe
windows7-x64
8ded033da36...58.exe
windows7-x64
7ea55e146fe...59.exe
windows7-x64
10fffd0cdd49...d6.exe
windows7-x64
10Resubmissions
14/11/2023, 17:31
231114-v3qg7acf42 1014/11/2023, 17:21
231114-vxdw7sdg61 1028/10/2023, 19:29
231028-x7cs1age56 1024/10/2023, 13:29
231024-qrn3rsdb6z 1018/10/2023, 12:04
231018-n8ybnaeb31 1007/09/2023, 12:10
230907-pce1wahe2x 10Analysis
-
max time kernel
30s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
07/09/2023, 12:10
Behavioral task
behavioral1
Sample
013e80dc8e53bd7d98dd94915f05563499b6a323df343bb765a1d3f188753aa8.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
040677c072d3f39edc3d3ec5f95573c1532875c1d57ddc1b62ce396afae016cc.exe
Resource
win7-20230831-en
Behavioral task
behavioral3
Sample
0ba3a15c5f29bca02e4b54f3146092558841962e5ee66a87218f130a4dfec36a.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
19d029dd80a0823d4abe2dfea87b17935844142cb0921eb35a390f70d5f522b2.dll
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
1ac4f94c2d34dbf38aaf1b7b7103349479fbe5b427e45fd213d4f31845958b83.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
27861dacdddfebc6862f96085da5ede9249b76bdb4b7af16371c51caee417503.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
31860041f633899f97e48bcd189a406bdc37d6be297b3dd6431f446aff2852ff.exe
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
3c49ffd8bfdcc42aee16d8679893aa28f3ed5e433dcf0900ed32f7a88da3f386.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
41edb742c1b69881657a48b74568410eb0dc7bfc9f540ab15c4ed0a665d97d45.exe
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
4ad4c837ce02e146680abb4f673fbca2d5f8588f4ae2c766b393c2b4141a9ee1.exe
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
50682871a2a335d7c5f89cfc1ed16bec99abfa7856a05f54477ee639bbbfd453.exe
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
5f3bfe76bbd22dd8fd936b3833220ba03964b08e28ecf13dafdbbae24a620cb6.exe
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
784f3902fdf296683a82c32aba987fd4c12bbed74a6300582da2d53e23954112.exe
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
816c0e4debc58580e62e0698d31111436c8f99bd895ad2b4d0c9b7c2798dd96c.exe
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
81b49d3c6151419a242ba8491dff24bc345ba1dc696ff9c6aaf3c698bacefea9.exe
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
8ba3f20419e36946e978e69ae892805569a3b8e5ae702038065296aae8dc414f.exe
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
962bbb1929620dc69e35d52ce7e9684412e16e8ad2727222dbe3e47e9220f8e2.exe
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
96f2bcea04abecb6ba4e87bb6cd62beb439882a9bb013fa12def110ea3335528.exe
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
9972304b5cf97f0369e5b287583931d87dfe984aa698c9123b7061379db68e64.exe
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
Resource
win7-20230831-en
Behavioral task
behavioral25
Sample
bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
c0ca77690ad65d797c3c9a662229046b0cc28e89ca54e0e39c70f656201280a5.dll
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
cb0f8c9180b92b75f130ecdd9fd42fa9c687796313cc968179d1c9b217c65e69.exe
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
cfbcc54f36dbdfc8d78d2be3a6b565f4e25b4d52f51de10ad7e4ca14c7f55d29.exe
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
dd0f55e997999bfddd040f676fd616b99afe386daf1a69c3a02a8324274baba3.exe
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
ea55e146fed653416bd40c92ce89cd61b46035c7bc6f55a33c71a9872e2c9659.exe
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
Resource
win7-20230831-en
General
-
Target
bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe
-
Size
137KB
-
MD5
34796bb71a194c4efe6154b46db6f4e4
-
SHA1
d1518518198c23fe4226ed61b52c4c7844246fe1
-
SHA256
bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0
-
SHA512
6fbd87c03417aba7875ec07f42dfc078dcb5e36cdf3f80657d97087651a77f49a2345336e841a486e89c66c8e373fc7e19a572ab5124dad51eb01829df5a2472
-
SSDEEP
3072:62BuFSglbxkKbjDOfuCtihXwnTP/vhaBxVGVq0OP:62BuFSglbxkKbjDOfvixwjhaYVE
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5F0D3D1-4D77-11EE-A15F-7AA063A69366} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2772 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2772 iexplore.exe 2772 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2520 2772 iexplore.exe 31 PID 2772 wrote to memory of 2520 2772 iexplore.exe 31 PID 2772 wrote to memory of 2520 2772 iexplore.exe 31 PID 2772 wrote to memory of 2520 2772 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe"C:\Users\Admin\AppData\Local\Temp\bfddb59433bec29faf6210449f73503f38e61234c09be3f405be8196d9d6f8b0.exe"1⤵PID:2028
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594babffe0a948f7e5716e87d3e997031
SHA185a660d74db4ee855ec381cc17ee28481ca648d2
SHA2565761ce59eacbb035bf5b7ee775eac4e4eb202475cda42dad8ce2872d3b2cb4d6
SHA512fff4cb35699990152c0182d2a1290103b2f2617b0aa0c79c6472d1df55a8b70800280e8895a8ec12c2feac2bb0cd7644efaedbf8cd0b3ae3c8357ecfc0047b70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532a53b7b59c3380d90213a3f76ea68be
SHA19c7005173a77aa432f420ced000c19e4139bd167
SHA2562a5868200c693b603f9666aec380df3a6b6dd84ee70ac5f4d5ef0945ac0e80e2
SHA512943f811254b35c8ee2794b3b6d358e918853c920b8dcf42517d59cadd20265f2430da8f7c2ded1d16713b6380ddda9fdf2a21d696693a149c14dfb6e02fe1184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3e1720667ae52b7defb2ef0da151cfb
SHA1621f190b6d11cdb4c9878b27298897bfafbe4ce1
SHA2569ca6e9ec451a1f375d5b452742c2e883b33b838a9e565334474475c3220438ea
SHA5128c868998348526cbe68c9a59997d8b13644cab351f224575a0460dabeac6026873679f8adcb3d02be174551ab94b0eb552eaf681961ef7a1487e8e75a062efd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beda4756f22df9ff553b19c4410fd66b
SHA18b544c0acb5d397b13f5a88b9f6547dfc3e92805
SHA25635b99b3667d70bdf7b9d216520a90f0e3dcb14baa3c46264648f32ed3578e3a7
SHA512d217c3a443be25cbdc5ef3ec67cc47b1ba73451907a4feed5e680999a507d46eb02f2cba31cb9266eeb5a7d54989ff15d36e99e52febbcac66d6afe2fc8e9555
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd2e6bb4b8d94ebea4e2f6af60e8f852
SHA10a07e6146f2f78840b61bbed32c036e369a2534e
SHA25608c4be32c3cef3df8a3cba9bd4e79aa2c4d52bb3696a5e8095fe73274d4e25d2
SHA512861c231b96afc62c9e3c6a9be3a587b248329cd4ad6d91f39d7fb8dbc86b5595b2f2e9c233578b8bdcaa9388c3d1b6d6480c58bbc4fbd4211d536affbc616366
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d5334209edb0803b3411e6ce73a1d42
SHA1787a037b66bf6d43cf6e8d5161d62783fd4b26b2
SHA256c12dbc1a03d96e1adab9c4e6a363861b95a16e4bc6a6de2c4a01706fdf3567b8
SHA5125998046a79d74ec6dc72c11429e077f7ff6cdcf6b7ee9156439dd8d6a2c22703b5b593dd4adfccc42f9519ef3d3f3672b6b0dc7d434e6ab926f966dca9b93d3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c393fcd3b58232fa230dfab30d571346
SHA15942b18dc834facb528c8f056b007470d3d359ba
SHA256584e2bea881c08b52d00e8a49a1522cca1ca2cece542eb88c96c605c43c164ff
SHA5128146a60e16688bc210fa4085259041ad2ca39c410441da5963411912ff77fc5394d1ed2d1676d5c9cd3b6c02bf1aec36b938494e6d9dfa372bf91b2e0b02ec22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5d7ad02ba59f4764011ee7dac7a09af
SHA16d4d7fe07f2303f6071ef79161e54d8049f7d4b8
SHA256447c398a1b9f39b259ae78d6a46cf1cd2cce5f6173615540c03faa4bcf047015
SHA512792092e8c5e12acb006d11c1bbb0d73532fc744e476799f74ddc45d7d508c41125d6fc92728ed817c3dc30c419190db8d2bd4e66ee1cc667388c7d9d465849cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ccf8f79d7de670a9ca6c4bee3e02a46
SHA11b3a88c9c80ebad0f85cd4d2b820d9feb5046990
SHA2561cfc8f600a400dd77e00329770684da48b02643d3bad4a26c676cd4616175ff6
SHA512d4fe973a6588d263e2376bffe5417e03ef88233e331c2747e8f3cf02e34d023bf7145162f009f0c587effec642cb27f2549e795a9526a0da13c37af65896d0a3
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf