Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 06:26
Behavioral task
behavioral1
Sample
110801d8482b4247c84882dc032e377e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
110801d8482b4247c84882dc032e377e.exe
Resource
win10v2004-20231215-en
General
-
Target
110801d8482b4247c84882dc032e377e.exe
-
Size
25KB
-
MD5
110801d8482b4247c84882dc032e377e
-
SHA1
8e6d1d5adf86c6b8c55832a0e9a43f0f82b78cdc
-
SHA256
ddacdf7a7d7f171f6e4717b215289b58675194149eea69b9637f726871065759
-
SHA512
80337537aa25cd9c55adfc29e5b3e4331187b6402c8f7e57a00136e7c7e7375912c20968f85c27ecac5b7072c4c20fd44954db557c74d3fc633f0c7a4354d294
-
SSDEEP
384:2AhlgI/HULp3PVUoWkq1mcKP19SUMBGpLGQNPC2a+VkjFQwEcKoYSr:2AHAp9Ulkq54PSUHS+62cT
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1996-0-0x0000000000010000-0x0000000000027000-memory.dmp upx behavioral1/memory/1996-3-0x0000000000010000-0x0000000000027000-memory.dmp upx behavioral1/memory/1996-4-0x0000000000010000-0x0000000000027000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000003fa7985adfeffd022d427b5c9876f69d70f4fb1ee4f9aa89a4bdff4b76a6920000000000e80000000020000200000005c16881441ffc9025000fee542e6b55332d720965160bc3bb6b5350cbf81dab3900000006e596d98aef09d7ae357bd77d19a1c6135d38cb37900569e5d808d30165a4cd7171363fb46c9e84eb99b8e37f6594a155564926d0dd99e41ca4052cd10a028c583f747f4c4a9abef061c97f2c1aa306a508cd4dbb7ae067fcd11e858c4dfa1afdb3f736ebb4ed2f74a5e6f49503e8ec190bcfde69d0bd0678492e97975064e8baea38a07a30e218e9709bc5d40e0b9cc400000002e8412b9c69aa7d04b44f03fe05fd2138ba127d7683c1b8d5a67bfcb2801c545bb07021b891acdbca3b919c7bfec0ebf812fb22ea0777ec02586c89683df32a8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000065b3366df495530f7acc1488a3c8a42abb86422aec335f3fada493205e0bb2dd000000000e8000000002000020000000f28794bfd4021f2e5f7e9ec40989c7a3e97d4bf21fc6be7da829875b01625937200000005b68a75da0110b1fa33f7e38f98bf81a2820eddecdfc5cde7e735f82713e9aa3400000005cad3fa511514d6d49fc958e60f3c729518ea910dbba86bf2d29caf20431b3c1bfebf54f5ac8c8debc7f5abc96bfce8b143a305f28a45fccbdf29c74dbc386c1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a61835713cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69F434C1-A864-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = b104000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2856 iexplore.exe 2856 iexplore.exe 2856 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2856 iexplore.exe 2856 iexplore.exe 2668 IEXPLORE.EXE 2668 IEXPLORE.EXE 2856 iexplore.exe 2856 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2856 iexplore.exe 2856 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1996 wrote to memory of 3052 1996 110801d8482b4247c84882dc032e377e.exe 28 PID 1996 wrote to memory of 3052 1996 110801d8482b4247c84882dc032e377e.exe 28 PID 1996 wrote to memory of 3052 1996 110801d8482b4247c84882dc032e377e.exe 28 PID 1996 wrote to memory of 3052 1996 110801d8482b4247c84882dc032e377e.exe 28 PID 2856 wrote to memory of 2668 2856 iexplore.exe 31 PID 2856 wrote to memory of 2668 2856 iexplore.exe 31 PID 2856 wrote to memory of 2668 2856 iexplore.exe 31 PID 2856 wrote to memory of 2668 2856 iexplore.exe 31 PID 2856 wrote to memory of 2788 2856 iexplore.exe 33 PID 2856 wrote to memory of 2788 2856 iexplore.exe 33 PID 2856 wrote to memory of 2788 2856 iexplore.exe 33 PID 2856 wrote to memory of 2788 2856 iexplore.exe 33 PID 2856 wrote to memory of 1676 2856 iexplore.exe 36 PID 2856 wrote to memory of 1676 2856 iexplore.exe 36 PID 2856 wrote to memory of 1676 2856 iexplore.exe 36 PID 2856 wrote to memory of 1676 2856 iexplore.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\110801d8482b4247c84882dc032e377e.exe"C:\Users\Admin\AppData\Local\Temp\110801d8482b4247c84882dc032e377e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\hhnPDEIGTv.js" "C:\Users\Admin\AppData\Local\Temp\110801d8482b4247c84882dc032e377e.exe"2⤵PID:3052
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2668
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:1192966 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:341009 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9320a162380fa01a8ed88dbf26eb199
SHA13831bf0ee71101bc8370fe794adc1cdc8260fde3
SHA256b045ec60e9f94ad2a3085fc478f76cc0ab20c69b1a25a00414aa06e52be50763
SHA512dab4e6b94ebaba90c945ebf673898a462a56de3c24460aa28171dd4f3de02502cb50e77b08f77e0726e36a430cb4e94f9739e0461006e55c6c1cd2c588ab2fa8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9cbe471f058529bd252bc963ae58d9f
SHA16d88a5a4f9f25eafb89c2c06154ad92fb60d6bda
SHA25605a944c1893830b8c5e765ecdbcf9b82e7e1fe7a307ba388f0dafa5e93502ede
SHA51272526676f0e7c47741d0e79acc492359193d158c98224a9b57de0b2d42e0c18b2fe62d84ac67a54744aa3dd0636004201de35b74967937c1dee4834781f42c98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5881e22382cad21fcac6ef4fa6dc08d85
SHA18e04ea3e98fc9cadf4f91efee1bb83398358b47d
SHA2565e019a9baa0f05af78ef43f0c66b874a36c63b66f1b6af1b59bc62037876fdc3
SHA512c5193e1bdd5958fc935bc769b0def79edc3e6980a252942e474748bb474264e50d32a0acef9ea34720f7e0f5579da97dcbdae5d274c85f033925c5880165aec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ba085eee906e706ea9b47af7572454a
SHA1044236abeabd012a0c75274946799d449425da00
SHA2569e832fa80528fd2119df258a6ee37ff4201150b40d936835f6a6a0047f1060d1
SHA512dea1c24ae0789cf7024110fad9c0f44537029d6a3ec6371237967452d5d846828f2e64166de80ccf4f9022804bad72f57aa2a644c022647047a813073f17fab8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\favicon[1].htm
Filesize291B
MD5b73189024a094989653a1002fb6a790b
SHA10c44f096cd1fec253c1fe2fcfcd3c58fe05c402d
SHA256014c471c07b2bc1b90cf5b46eb8eb60abe3ac278e43cd8fcc7c4e6c8950c592d
SHA5121bca726835d33847812060c968e5306535f513429de5c90d66942155fd42ff75508dba97da8ca36c6d6e6a8df5a2602fe3be047bb5612ad4e367c6c00e1e50a3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
12KB
MD533c60858171478c3c5266122095b3e20
SHA1729787ede9f390ddf2250bbd1d15848e1e2be454
SHA256795f8ac902fc77d73ec28c7fdb14501c39c769ca0b3738500c39b82e896ecbdd
SHA512f4d5c016efb01555fd6e43f1b0a50cc45029e32a6f581b850458ef85b3f7b8727fa5b6645eb07e136a9f78675cd653cd8f6a5c8ad342992352d581db9be3b7c5