Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
209e4d0587ca0dd12bdd61bae3f84d87.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
209e4d0587ca0dd12bdd61bae3f84d87.exe
Resource
win10v2004-20231222-en
General
-
Target
209e4d0587ca0dd12bdd61bae3f84d87.exe
-
Size
56KB
-
MD5
209e4d0587ca0dd12bdd61bae3f84d87
-
SHA1
31ada5ee435b781061d6d065b2d4ec60e6807f90
-
SHA256
b964009584f24112b67af871333acda4e7652bb463a68df16b64564e78b5abf8
-
SHA512
e958f3b3d31577ab2a5dc9cbae38d5ebd9b10c4c5c2f07e978ccb925fc9f739528efc311bb28b766bc2c75ed53e594433b53675745df3f0b0c46dbc38700ed69
-
SSDEEP
768:Cs8ppOCMSnt4nOiucrM7xSAsgyqvPIGXMSBjX9tUivGXXsFJjhYQ:CnR2OIy4uytC7OkP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409917908" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38CEB6C1-A564-11EE-B517-EED0D7A1BF98} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1300 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1300 IEXPLORE.EXE 1300 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2400 wrote to memory of 1748 2400 209e4d0587ca0dd12bdd61bae3f84d87.exe 28 PID 2400 wrote to memory of 1748 2400 209e4d0587ca0dd12bdd61bae3f84d87.exe 28 PID 2400 wrote to memory of 1748 2400 209e4d0587ca0dd12bdd61bae3f84d87.exe 28 PID 2400 wrote to memory of 1748 2400 209e4d0587ca0dd12bdd61bae3f84d87.exe 28 PID 1748 wrote to memory of 1300 1748 iexplore.exe 29 PID 1748 wrote to memory of 1300 1748 iexplore.exe 29 PID 1748 wrote to memory of 1300 1748 iexplore.exe 29 PID 1748 wrote to memory of 1300 1748 iexplore.exe 29 PID 1300 wrote to memory of 2848 1300 IEXPLORE.EXE 30 PID 1300 wrote to memory of 2848 1300 IEXPLORE.EXE 30 PID 1300 wrote to memory of 2848 1300 IEXPLORE.EXE 30 PID 1300 wrote to memory of 2848 1300 IEXPLORE.EXE 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\209e4d0587ca0dd12bdd61bae3f84d87.exe"C:\Users\Admin\AppData\Local\Temp\209e4d0587ca0dd12bdd61bae3f84d87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcb6acbeb3620f82179ae58074c84f1f
SHA14352908fda0791d4d5d634b293dd04b546dd8658
SHA25607c1f11d80e39bf0e3b40367352c4f6d16cfab1180b2cdc998f8fa6e1a4074b1
SHA5124aee6893e977ad855d7ed7a603b28475f72616542cb9a1c0ae65a5ac1101da7b123433ef04f39993e722c8f17ee0c04404244f4e33944df04cf65e0172db31d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b77a8a3520466c83df90a3d9b1462a17
SHA1a8009104bf35619e07c613eee907fe21f74fe457
SHA256ee111c21d6c950e91948622bfb269ad2e550ad8ff85e4da29272fd93c4280d5b
SHA512998aa5858ed3809a918115e19502fc208004fd70210d0b68733ddb0537a68f9b5d37a28a38652ac0576e740dc2d45f2805a8254db5dfe589ea507570014921dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb1c0ac7006693b861230a400e76c93c
SHA1282e4191563a3042c04fde6ed32fd31a1ef57235
SHA25673a8d02dbeb53e6a3551fe69d135d5c95de16e983c51dbb8b14b9022111357be
SHA512b543322a365e1feec6a5686dfbad212ed2a2b0c35e1462471dcbba3def2bb0e9c584db61c046fe68af34c56ad96358fa6272b1a13e00feb2866e391ff43622e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7769570d2deace0b3c4e283f2fb0cde
SHA173deb775740705342c3b73e6b45d7a6cdda4799d
SHA2566e8408f7eba4e66cc89d5ed0c1884294e88faffafcbcdada554a5df0076b36ec
SHA51285f83b99c79a48134ffe521f8300ee3ef611825fe7d851d34744e344e41ef7b869a6b88875fd18b87979a1df7377d4a13e5319d38a0b4d7631591d0cabea3669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d1b0cbd03c9a650a7c99b745635da55
SHA1e2ad3bd26f5a151213f981b668baf5392631a6f1
SHA2560dacb6840203d958e56cdf58b7f6a2fc09de6f33961d43674f2271f835b0b0b2
SHA512ad47cc990802debd9cbb7b33d9d003133836af9b0f17ba9a296e9ef8d2dbeda5ffd4053b79e0d37bb5171049d214c80e29c5502fcf26503c7b3d7f065f0701ae
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06