Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 04:19
Static task
static1
Behavioral task
behavioral1
Sample
963b37b4582bc3f36021b801338a8363.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
963b37b4582bc3f36021b801338a8363.exe
Resource
win10v2004-20231215-en
General
-
Target
963b37b4582bc3f36021b801338a8363.exe
-
Size
14KB
-
MD5
963b37b4582bc3f36021b801338a8363
-
SHA1
285000b5160ba424e8f084c37a7df99f6e9833a1
-
SHA256
06fc1779292668a9d5aa606e5d3c06390bbbffccf24023be28a522e182ccf36a
-
SHA512
63134930f805f80af94cf8220d609359c0ab6fa015ad1370eb32c2936fa8ba40c5aed253d788d961c945423ac64521249835f43f12100b78038ba0b059cb54f4
-
SSDEEP
384:+7Jn8r3JUv0YLq14ukfaX1tJNNnU/s7U4:QJn6ZUv0RkSX1b+WL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 963b37b4582bc3f36021b801338a8363.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3458354383" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3458354383" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31087978" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3476479144" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414476571" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31087978" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad000000000200000000001066000000010000200000009e016207b2345822118da55fee27cda50e5d77f34df58601c5dafcb1cc475fcc000000000e800000000200002000000052faecebc3e4ff553c648a9024c946fe6c4fecfd3bad892defefd6b23899c1222000000035f0508b34fc2bdb40059057b92f066b9ca6de66ce793862c40c75847bb7e8d1400000000fa42865162df31d148a77fbf53f2576ec90a660f6578d6eda48a4ba3d993c462b49210facdd9945b475552d9e147b7387a3c1ecb1d06aba2709557bd4389577 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08c71d06a5dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F9B3F905-C95D-11EE-B7F4-EA184F49D407} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31087978" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad000000000200000000001066000000010000200000002a290cce3bdee5d372457fbad047ec367359f1b35dc1202c2eb80b09c627c857000000000e800000000200002000000086afdf5f86ff10b6da5e6cee6d14ddbd05d4ba19cd9bcd36c70ac3357d2124a120000000c873e45b6f33be22905089ff66722b9b4ed2f9acfd8a1f5bd5147358eeffb9864000000081948c06b97465140739065f1e7e9c0acdd945bd4d04beafc2e82a9a3c4b8e4728a5347c3c542742d88392050b6174878f961912ea8ca987cc6406f2b7aea99f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0085cd06a5dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2528 963b37b4582bc3f36021b801338a8363.exe 2528 963b37b4582bc3f36021b801338a8363.exe 2528 963b37b4582bc3f36021b801338a8363.exe 2528 963b37b4582bc3f36021b801338a8363.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4036 iexplore.exe 4036 iexplore.exe 3324 IEXPLORE.EXE 3324 IEXPLORE.EXE 3324 IEXPLORE.EXE 3324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2528 wrote to memory of 4036 2528 963b37b4582bc3f36021b801338a8363.exe 83 PID 2528 wrote to memory of 4036 2528 963b37b4582bc3f36021b801338a8363.exe 83 PID 4036 wrote to memory of 3324 4036 iexplore.exe 85 PID 4036 wrote to memory of 3324 4036 iexplore.exe 85 PID 4036 wrote to memory of 3324 4036 iexplore.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\963b37b4582bc3f36021b801338a8363.exe"C:\Users\Admin\AppData\Local\Temp\963b37b4582bc3f36021b801338a8363.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://a.doginhispen.com/149/in/htmlg3870458449.html?cid=51094673&aid=10381&time=3870458449&fw=0&v=149&m=02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4036 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3324
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD56e89104dc54cf9f6ef8ec2df9d38dc2b
SHA1ba9fa8653a6c58cb3d8c7bce69d8ea2baf78db61
SHA2564c94a38ada16dde13fe44544154beb16b85545366b221f34470146ff9fb653af
SHA512649d1cb392a06c3791f531d4f9469182497f2bf9b4bb1ae0e83c64d6942c33796d0735517f36c3a7d08c85443e7f791f613ecb8eee18fe89cf19d0f76539bea2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD59c137aece0a72667f927d6970a6e0c42
SHA1d61e332a13104065228361bff714e54badb717b5
SHA256d3f83eef68d1cfba1b9239c19754f6e492e6782574d325f5418100ad92da1167
SHA5121b98b88a06e6dc0461ce1c6d69719cae5f73aad11fe04e9b248b3d9b908991ebc0ae9088ffc29c92eb5832190bfccdd1adeb3f98bdb5972b97b4511824e7b1d6