Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
SuperDebug.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SuperDebug.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
绿色下载站.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
绿色下载站.url
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
绿色下载站_百度搜索.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
绿色下载站_百度搜索.url
Resource
win10v2004-20231215-en
General
-
Target
SuperDebug.exe
-
Size
851KB
-
MD5
91c86d309860a56ce80e9a493a224e00
-
SHA1
2305910467169ce81251e5806eb8630cf1adfec4
-
SHA256
c97f87fa5056c992abdb21babd803d117432b0e9cc9fc3126005497c29628ac9
-
SHA512
064d552a6e78003828767e40db49efdd69093dfea00b58dc353eaa23f57c871bc86fc36089d0f98d9bc7e9c7086310122c3d873084c8261f55bfe2c9e7671ad2
-
SSDEEP
12288:6eOYmHyNYLoQAUHBXNszSDaIQhkutlzpoGzzcUotHD3pZfavKPluH25izhm:6ePmHyNYLoQAUHBXNjJshDEPH7hcKi
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2736 SuperDebugSrv.exe 2196 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
pid Process 2896 SuperDebug.exe 2736 SuperDebugSrv.exe -
resource yara_rule behavioral1/files/0x0003000000004ed5-5.dat upx behavioral1/memory/2736-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2736-12-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2736-16-0x0000000000240000-0x000000000026E000-memory.dmp upx behavioral1/memory/2196-22-0x00000000003D0000-0x00000000003DF000-memory.dmp upx behavioral1/memory/2196-23-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px518A.tmp SuperDebugSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe SuperDebugSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe SuperDebugSrv.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFCFC261-A8D9-11EE-B989-46FAA8558A22} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410298326" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2196 DesktopLayer.exe 2196 DesktopLayer.exe 2196 DesktopLayer.exe 2196 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1812 iexplore.exe 1812 iexplore.exe 392 IEXPLORE.EXE 392 IEXPLORE.EXE 392 IEXPLORE.EXE 392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2736 2896 SuperDebug.exe 29 PID 2896 wrote to memory of 2736 2896 SuperDebug.exe 29 PID 2896 wrote to memory of 2736 2896 SuperDebug.exe 29 PID 2896 wrote to memory of 2736 2896 SuperDebug.exe 29 PID 2736 wrote to memory of 2196 2736 SuperDebugSrv.exe 30 PID 2736 wrote to memory of 2196 2736 SuperDebugSrv.exe 30 PID 2736 wrote to memory of 2196 2736 SuperDebugSrv.exe 30 PID 2736 wrote to memory of 2196 2736 SuperDebugSrv.exe 30 PID 2196 wrote to memory of 1812 2196 DesktopLayer.exe 31 PID 2196 wrote to memory of 1812 2196 DesktopLayer.exe 31 PID 2196 wrote to memory of 1812 2196 DesktopLayer.exe 31 PID 2196 wrote to memory of 1812 2196 DesktopLayer.exe 31 PID 1812 wrote to memory of 392 1812 iexplore.exe 33 PID 1812 wrote to memory of 392 1812 iexplore.exe 33 PID 1812 wrote to memory of 392 1812 iexplore.exe 33 PID 1812 wrote to memory of 392 1812 iexplore.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\SuperDebug.exe"C:\Users\Admin\AppData\Local\Temp\SuperDebug.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\SuperDebugSrv.exeC:\Users\Admin\AppData\Local\Temp\SuperDebugSrv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:392
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1131d63abe25ad442fc7206ad2d9e09
SHA17867067c39f66b33774c23ca425de3c8656c4de1
SHA25645f080de840b4912b37d729f75c7ed953d3997fb8885a1f21b401e992567cdb6
SHA5121bf5631a567e7b867fbee7860b2cb8e59d98dbd5828a536c700e00a3a39485921ded9ba3d44f54262f450a70bb3acef0a3cf54b704e762a1d42e6f1bece2f408
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514e11926f370fa7060dd1ac003bd69ba
SHA109863437a7382dacdbc55ec4546d14c98d61bf6a
SHA256abe7c52028a55a6d64b121b4aa6cd5c591c7185d480f41316b22dc3d009c6609
SHA5125c4e44bc4349182c36616ba3ce8bc0719c65788ee8e6b83a6ce1c939f820640bf1bd1b0a4d300b2b9f38291d3da3f62260358e522137c1fc094a7cb0e2414a34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589807472c4c8a7cf062ebc6239db73ad
SHA16f322af65e9fba353c3b36d8ff520d671be2d9f0
SHA25625e1c3f1c8a9c609663262ad0c7d82e6420b4f026b7d8439aba96f0c2aba7676
SHA512521229ee1e8ce68a47c1c5154a55bc846bc949f1277038f120a7b0844de07b19687a28f6a3a6b847636b51f879208001412a744039cbe478e4873ae5b4b0eef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3d1a5ad0ae1ce7000c5370c72989421
SHA1688f8f9238c8466372c445876ddf70af7c9e5c5b
SHA2568577f97bb4815c2ac41d5b4ba8189a31c27f6afbc613e0bbb2d69012feda2b0b
SHA51260d85f84b36c92aac3111659f6bfc5be02c1ce51cc3f885ab9239edc980c4b2c7abc9143c553e1f8769af25a12b592e1105603c9d36a61a68110cc0a752aba98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcacf47958191de1a2a86d27a6445abf
SHA14f27b733bc101b793fb4f3506f41dcffdfdd033d
SHA256fd760bf933329b27eda98a04125301cd1e3496382383004e80310bc4e28b4c2d
SHA5128b18e27bbc9efe988e2b28a05cffef6e98d19f55e4b2528eb92f72a4e9b19ff5f500017e1a24ac5ce664bbf20feb33e00bde633b212978fd47eb7a52c0fc1f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4f6582f824656796f75cf627759f1da
SHA105fb8d2b670db69a26e5b99a260b5f1cf956b826
SHA256f77486a1713c45694f72dea525538323cffab065bbdc77fb8c7d37d5e1a1c48d
SHA51273909c86866128aed4b43a914a994308f3ea630b1b0f193756f2b796281d72ec8ada461b6007f10ab0c20ca54f69e4231cc836de55c44551ff3a23de2124353f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b812673f550ebf41593fcf24cdb28573
SHA1c67b88cb9755cdacbe9230682deb0f5e979d934f
SHA2563d9b94d1f28bff91f515cfa2f6acd1f4f69445c2bcbf9da454b3b3e8502c9c56
SHA512718b3dd34712c2c7314ecbc7ae4aef06b29a791830f409630391b8d31673a56aa4aa5cef52dabf39d7e4a54d1ae3f0d44f8adaaa9df89a19cf96e9b06351d169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5def3f5517cef45bdb198e19a96a09f1a
SHA1bf870bb93a949f5663fc7a8229bf9a03d474cae0
SHA2566ee9469945c822266c4139d13529de5003e4d7f26b71839fb58bbe21d7c39af1
SHA5121ba68e22be4e442e19c07ceb15ed52ddc2209773ab7eac7f28b13f5819b432b65fefa3b99bc4c6f37053bfa2cb7889c7af86ca41694fafa62aa3033e33c74df3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbd854488afd7de4126b3cf95aadd5b5
SHA12743e9bde95e074e121c0c5aa8d40ace0aa56d02
SHA2560298533b25f7fd4e5eed9d0ef6cc8d1489fd05e76aadd0a88d0b66f3894d7716
SHA5126445ae454213e2574aae2c7d025aa83bb48423939a5d20d82512aedbbfa591c0fffc13f9fc03bb8119756a805ba5d9550533147e1b7e53912a6305451ff05e70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eb83851f25e30621e0e5bb32bbed18e
SHA189775b065d7ee573aa4f631e036a2dcd7ecb2c0d
SHA256e21ea2fdeb201cc7082cb6e902ca5e6fb49ffbe7384e2abd16f774aac826cdc4
SHA512da35d32eada4641c352d70dab369f0ebfe36134ad770c63c6fd78dc76cfda26fec6d23cb0748d8f16b6735d4981346d572d150fcce16763b7be9aab9ec0b2e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d172fb88df3ce996aa0720601b118da6
SHA1d7142cd5735e6d4c62a2a590eeec33304307fca2
SHA25673dd7b63d464aeab91912e62fbd7c8a468c7cffd2a65b03ae902519da6455554
SHA512bba7020cc151270c89de4cf98d93d896b6c5657d89eb440f829d2a7220670cbfb636622ad879e78c644c6bbc2f04f219430d78b28688f7c6f8d0e61fc6771acf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06