Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
481d2b0445ef3b32e99231c580108d8d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
481d2b0445ef3b32e99231c580108d8d.exe
Resource
win10v2004-20231215-en
General
-
Target
481d2b0445ef3b32e99231c580108d8d.exe
-
Size
56KB
-
MD5
481d2b0445ef3b32e99231c580108d8d
-
SHA1
cbb06e95cd988f12f09616d083570782bfed78a0
-
SHA256
0267c2dd7b95083c44789ef947886e25143a203342ba8cc2bcc7bebea2b3b58d
-
SHA512
0275ffbd99adfb5b5fdeb8ad617eed6ae35d10255355b7d8daed541520bd0d23edf9f1cc588ee8660fc383ebf221ce71a629ee122d412c51db247e8d7c145fc6
-
SSDEEP
768:q2DiFixA95VlLfDjwDntbGTmOxOQCJCdzu59ebLfqzMZ+27sLuWDv8/:jei0Kbth+wJAQI59gLuWw/
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 481d2b0445ef3b32e99231c580108d8d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\dlnblz = "C:\\Windows\\system\\lz090107.exe" 481d2b0445ef3b32e99231c580108d8d.exe -
Deletes itself 1 IoCs
pid Process 792 cmd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\system\lz090107.exe 481d2b0445ef3b32e99231c580108d8d.exe File opened for modification C:\Windows\system\lz090107.exe 481d2b0445ef3b32e99231c580108d8d.exe File opened for modification C:\Windows\system\lz32dla.dll 481d2b0445ef3b32e99231c580108d8d.exe File created C:\Windows\system\lz32dla.dll 481d2b0445ef3b32e99231c580108d8d.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{206A3691-AD1B-11EE-9792-76B33C18F4CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no" 481d2b0445ef3b32e99231c580108d8d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1976 481d2b0445ef3b32e99231c580108d8d.exe 1976 481d2b0445ef3b32e99231c580108d8d.exe 1976 481d2b0445ef3b32e99231c580108d8d.exe 1976 481d2b0445ef3b32e99231c580108d8d.exe 1976 481d2b0445ef3b32e99231c580108d8d.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1976 481d2b0445ef3b32e99231c580108d8d.exe Token: SeSystemtimePrivilege 1976 481d2b0445ef3b32e99231c580108d8d.exe Token: SeSystemtimePrivilege 1976 481d2b0445ef3b32e99231c580108d8d.exe Token: SeDebugPrivilege 1976 481d2b0445ef3b32e99231c580108d8d.exe Token: SeDebugPrivilege 1976 481d2b0445ef3b32e99231c580108d8d.exe Token: SeDebugPrivilege 1976 481d2b0445ef3b32e99231c580108d8d.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2624 iexplore.exe 2624 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2624 1976 481d2b0445ef3b32e99231c580108d8d.exe 30 PID 1976 wrote to memory of 2624 1976 481d2b0445ef3b32e99231c580108d8d.exe 30 PID 1976 wrote to memory of 2624 1976 481d2b0445ef3b32e99231c580108d8d.exe 30 PID 1976 wrote to memory of 2624 1976 481d2b0445ef3b32e99231c580108d8d.exe 30 PID 2624 wrote to memory of 2000 2624 iexplore.exe 32 PID 2624 wrote to memory of 2000 2624 iexplore.exe 32 PID 2624 wrote to memory of 2000 2624 iexplore.exe 32 PID 2624 wrote to memory of 2000 2624 iexplore.exe 32 PID 1976 wrote to memory of 2624 1976 481d2b0445ef3b32e99231c580108d8d.exe 30 PID 1976 wrote to memory of 792 1976 481d2b0445ef3b32e99231c580108d8d.exe 33 PID 1976 wrote to memory of 792 1976 481d2b0445ef3b32e99231c580108d8d.exe 33 PID 1976 wrote to memory of 792 1976 481d2b0445ef3b32e99231c580108d8d.exe 33 PID 1976 wrote to memory of 792 1976 481d2b0445ef3b32e99231c580108d8d.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\481d2b0445ef3b32e99231c580108d8d.exe"C:\Users\Admin\AppData\Local\Temp\481d2b0445ef3b32e99231c580108d8d.exe"1⤵
- Adds policy Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\program files\internet explorer\iexplore.exe"C:\program files\internet explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\481d2b0445ef3b32e99231c580108d8d.exe"2⤵
- Deletes itself
PID:792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100B
MD55b64e85c648c3d5ff54b924a98a71c92
SHA14e48f48ad0957a43449f679eb8ee7a0c701650e1
SHA256ae8b005ae3e6c7b03468166c1a56db580d87a23dcdbe2d20ebc7e684ad08cc29
SHA5129e5245978e5f28b969f92c17de4978e4a0698ffd9ac432bd73a4e8317c1983712933700be322976301979d49b67cac2dbf4a4f19d9ee856f9bc24a8987f9f75d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530f58de817425fa2fdb0a4b396883757
SHA15297c30a2066ed4da706445875c59f52f917c00e
SHA256530ad2c6e25913940ceae275b7e77e4ddb8152132f03202b68cd7c95350db5e2
SHA51233bb09492741784fdb39e50d722200a1b6e1e808f1022bdf5c1a593045a60bc1b0a4ee2eac5519d4e597dc9903e4c80e08c56464837f82b43d66c7392a11b0a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcaaa09d25df24d174c5a0e8fc4b0abb
SHA1c6ede4ddd7df6530558a6b8940970c1ed3831bca
SHA25605205962a3e32e44367d6087fb0e0c55b2c2aa17a13dc0150c4e6799a5e5f9c3
SHA5125c50036c475f7dc0ad578464c8dfe77d18c5c14cf75fe63e306bdcb4fc6d02101aa88dd7e98ce8c1aa7c61b577e285b5df01541b2222b61388cf5ebe13dec3ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525a486e5dc4544f4b1dec3ffa6afd25c
SHA1515a08527ad3f241ce977a3fae178cd901f1bfff
SHA2562301aaa60de8914c807b33800495ce643e6077068fdd1c76ff439792ad735a77
SHA512284854843b2bac8a7c1efb8db3a850564c350e9310bfd350d52a316d7e738cdd59259a5e88e8b6da769b27d39fab1fe46e83c4bad174672d310171023bdc7be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58550ac2e90682626d6b4b7974786bf0a
SHA15f6c7362a7f82aa51076dcfcba185bf6831e3eac
SHA256c17505c353d1f775532b305029530efb7e52f1d07681adbd90d0dd7a96e7825d
SHA512faf73cadac5f7d82b56a3e851a2412894e644aa04031ef8924d21cf620b71c0e44f2faacfe9158e47457350406907a7e2e7732ae44e12af856d1ea4eee33c8f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0973e6b218d615477d71aea2a8f7324
SHA1d2a616cd51edc299f5a552398ef0227bbaa07ae0
SHA256ed150698372e20c6807314fae13bfe042d7e358c87c42c1ff7fe0c5924d8f887
SHA512e2cc8cbd0b6e042812490e4e5cebb929a321ba0ffe0956d0e6f9f03bd40573ab5dc950c6e8f463c74227d677f3999ed5d78f4b45bf51b6fc19d24e25a792de2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552ede494ede19213c9c97c5de956fbc7
SHA1d7c60921aa86cef57d2607ae314ef2b6a377e200
SHA2564b1c603a921a1103b6d2770b3bc66735a25bb48be3cf139f6093efd4b5e71dd9
SHA512890fa002a8f0955efd77fc78644c5ea3cbbfbff68be06b1dd4d5d072e9245d9d01666455d795204e1acc9567b276c663d6ec80f3f25350f9d5eafe2d8665abad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beb2843c185a73f451c51123cdda8374
SHA1ac36a8f0e4ca3b21dee768192ac6293fe8de7c2d
SHA2566d79259fab3b3b3e7e080d8745eafeb4d73e9e9519bab941cdc8c626cc2a05c9
SHA5120706749191d0506182562570e9885a4e0a73399c6f3fbc4ed8a50a7e765b3fc2b677fa3226b423f90d977fb30f95bff130d132304e87d1af084539ddcb2370c1
-
Filesize
37KB
MD5ccfa6e58c7ee3b49209d37398c85b412
SHA1788f579102cb93fd6732fb2604e72480f22735db
SHA256412c82301757558027c5cb3ed1245a40d0a9063f583ecd2fdacf50f733c86b0d
SHA512c0137f7d51c9c1ca30f3690d26989db7f2fba64acf05594609518a169f243bfb06e8cbf461db6269e8c8123c8dfadb3d4717777adf1f2490d4b19b334510a813
-
Filesize
124KB
MD50abdd8a8c31ce398cb71a4239beaac59
SHA1ca74bb068d3c2e37ef6be8926a163fcce90a65d4
SHA25600ece81b8041099e52b91048593843530e1b7d54339122b45fe6de77d84cd328
SHA512ae64760a80b301ba50c2eb5b0a8fc3dc08091201e0b46119fd8e6377d7d9e2378d97786d153765a5f7506af872a3462e20cbfe1c37f9154d1fdafda34c68ed9b