Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 20:30
Behavioral task
behavioral1
Sample
f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe
Resource
win7-20231215-en
General
-
Target
f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe
-
Size
1.9MB
-
MD5
0c575308d12c2194af27612e8b97a57e
-
SHA1
8e8a8898fdca9b49fcaae1a9870eaac49cee8c3a
-
SHA256
f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445
-
SHA512
8f5baf02016305c351c84adccd02dbe987e7707735f2fe54b6a3cb3dbc847c34fd572923dc308e16d9388eb564bc15c0c6aa66e662b6697df86c7e6658720959
-
SSDEEP
49152:e5At40lo54psW/WsdiyNIPVSIpgmTPkvFZV:e5MTC5Sv/WsgyC9/gdb
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1716-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-58-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/1716-14-0x0000000010000000-0x000000001003E000-memory.dmp upx -
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x0000000000889000-memory.dmp vmprotect behavioral1/memory/1716-9-0x0000000000400000-0x0000000000889000-memory.dmp vmprotect behavioral1/memory/1716-60-0x0000000000400000-0x0000000000889000-memory.dmp vmprotect behavioral1/memory/1716-62-0x0000000000400000-0x0000000000889000-memory.dmp vmprotect -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5118C311-AB40-11EE-8CE9-D2016227024C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 2628 iexplore.exe 2628 iexplore.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2628 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 29 PID 1716 wrote to memory of 2628 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 29 PID 1716 wrote to memory of 2628 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 29 PID 1716 wrote to memory of 2628 1716 f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe 29 PID 2628 wrote to memory of 2480 2628 iexplore.exe 30 PID 2628 wrote to memory of 2480 2628 iexplore.exe 30 PID 2628 wrote to memory of 2480 2628 iexplore.exe 30 PID 2628 wrote to memory of 2480 2628 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe"C:\Users\Admin\AppData\Local\Temp\f8b626d638c4f7dad13330557c49b148a42a54e8d96da1767c6b413c653ec445.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.x5ch.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:23⤵PID:2480
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize1KB
MD53fb6b48b879b0f65f10810fd1995c08d
SHA18c06e78fa660066dfb68e8c8989cae3f6cdefcaf
SHA256bbde0417d7cc3e5145a5701df36bb6d748c8d13aa40a48b38cbd71ec9a27373a
SHA512cd2f75a7fc5adacc6bbc08155a1c12644d7fd356d32a36398fb53258107b42e66acb7dfdb3995584294205325ddad7c79c9409cddc077e73a349414bb57da0eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592eabd6b334f0a8c9862af44eaaa85eb
SHA1520f0e4afd991611f3c9259394dfbacf17d1e937
SHA256c365ea3020b17d38a0f105047c95fc0e3a7e73f67e01c9c9b79c01c0aee6b945
SHA512a22bae6716396498f0135e85ee9a33023aaef08d7318b3c994531ee5fe886ccae958e14152585f7b7f725c0edfc006a8c66107cc6e896c7d59a93b1eaa156b3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c32a2cad067c018bc3a6d7c09fd73045
SHA1ded3ddaa6270ac3d49fdfc7a82268ce6e1418c03
SHA2566313703ab87684924c285ff5f9ea69137279a22b4921201c16d8ecfb46c3a09d
SHA512d2bd3eff38eb24490c65d5bebd367664863fb4ed50dfd0d7c37feb0453fbbda30a935e8ef503ffcc26bea2ad64a1418690d87f8fefaa95f5df5e228b3e21d35f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518f06c5d0abe6e63029ff843db682b68
SHA1bb5d1f737a4148dc6a2c2b5a79e701235ff4891d
SHA2567c29517e1916917f726aa9fa2dc4d576b4a8222dc866483142ed0053b7fdb254
SHA512206fc0681ab7783b38996bf5d46cc9f70969cad92d78c8b20d643539539f2d0f46f1f082c24d8f6a43e730a06aca36cf77264baf9c370db70a0579c7ebcb800b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53de8c72960aec529bc7c539942682b6a
SHA13088204ae7ad15e7e2f6f03fbffa606219d414c1
SHA256c17d386c4c7bf6d22e3930f5e4798349c500767e69b6fecc03d970d8da7c3696
SHA51252286c79f8b6f2e53534a76a5285033705bc04f5c3a203255c35eaa033f0af50b50704a6482bb9bd0661fd92f44a8a7c8e4c003a1733ab5da158ce301bceed48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5391513307002f407ce826891c147c181
SHA152e2a8845de957d0b9e361e53d7df48fd211b18a
SHA2564597a8074b565c03311d5c31423f589c2757e0e7f7dd9f27abe0faddef2c3b5e
SHA5124deb0fdf9a921748761c63f2b8a99b914f12d254570b7510b0eb4b0ef7a71f1f5e67f27bab405909acf191060db55072df7459efc3b2bf75111da86a95d7e62e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558fbbfaadb2452d3a0886e7c317b42fe
SHA1aa04ce333d56355c3ee453e6eaabf612a68e0fbf
SHA256c8063a3ad0b262568592b014547f2c709eef6848f6bf6fd02fb27f7390bffb14
SHA51259d00f44f2ffd1117e68a96ec6532b6952a5d731e324e9a0789134ceb69807e1b5ac00e6e9c544cd9f7dd65e18e5339c5f0ae01614ac994be4ee4e4fd839e087
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fabff5e2c4deb9d59c227b24f142dd7
SHA14c1a0584f7a7ce253295b2ff5fb2701e8f78a4e3
SHA256b171981701e030699bf0672529e653f61cf3094863c513761e560da996478e6d
SHA5126a7ed06d21fad91952f98a34afc6c54fd337c2d88db3bbe3ef7c76efc2392b5beead1abfc2e96daa2484f45819e66fb5bfb1e2af3fe16a38713786ebbf9324a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501cd561a48283d13443da72864c5c1c2
SHA13ab07254904a3e24648772f306017071a59016bd
SHA25658c957b55319bc695ba4b3ed478c28d8b49f26625bbc19e6f142592a83a40f0b
SHA512fd3e3888150b640bdd2e9fa24659b11c5f5300e047771ecd55022c0a1556e1d2af4d1e79ef4fc17ccac9b4d68882aad41733a13c3d9f9812ea9b8d6864d1977f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9dccd3339864f880b9c0123dd574b9e
SHA1bd7beb5433afbf0a3be1283cc07c82d36218f18d
SHA256136d515e228e720c5f44ab5f792641e62d013c38ebe9dab41ed647bf3e61db53
SHA512db0a5539c7a757ef9356096809a539517a279d9f08b53e7012c70d50e2ea8d285d07a4274155a1ffb76d226415a342a8dc683865bde00f9280deeffabe27ac02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f564d9802ff8f011685993501da8a18d
SHA177d00ea96983c53705cf22da23cbb68baf1aed67
SHA256859fb2998c180fa8117a714c79699c3caf729e1d1c9da6bf2e9c8c1430f40974
SHA5120a94f5d52c41b36c812d5f131eddd6bdebb36c65eccd14ae6266708dd267aaae246ce1033f9853bc49baaab33825025354715cd3e48bf00b3bf3d847dbd7542c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec6111974f8e205748a1aed2c986a014
SHA1645fa97b1f20d53ad27c0b365240427eee73f1e8
SHA256d13b7f3a6b13e79961262c9e825db523f4f1c063bc7e6b1f059ad6e928968adb
SHA5128d0d63e20da6953f343a005f47353eba9c6f81cafac89c7f09910e7e7c738df9cc3ac88d8e96516e7cecf0c82f1aa7f6ee923c841a729b22028a40fb47af45e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d6c7a950eabe0bbb3c885d42d554cea
SHA198976f6aa8d1dff71c955ab9ab2d36cb1c828808
SHA256c25a65b9b226d26da2313cc5a65f6e3b7ed91a04c08a574e3892a44e4c3d3cec
SHA5127c908fda4a991c97b65ca95250e40e0b5df74d7a0bc48107654360fec3b4167844880f025a0c2958fb0c2bf8ad392bc3f5c10d4a3c62986afa8f6765cb3461ed
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\SPK[1].js
Filesize2KB
MD533e258f8f03b52d7b1b8c355f5c9a35d
SHA1f6e9539620e992f92c702c052eaa75cd79716f6d
SHA256014a45a8f8534fa77ffeb98a54af1ad284136f0b3a0028e9cbd04c0189fb47fc
SHA5123716826a530d3f2d9de8c7a1274d709811002fee940e8eda8c3f230ead33a03fc721f855219c52127afbf5c7323d24c418ad14f4f815ded16593fe096d75141c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06