Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
a08bc8efa9fa2e9d5d2074ef6cac5d48.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a08bc8efa9fa2e9d5d2074ef6cac5d48.exe
Resource
win10v2004-20240221-en
General
-
Target
a08bc8efa9fa2e9d5d2074ef6cac5d48.exe
-
Size
173KB
-
MD5
a08bc8efa9fa2e9d5d2074ef6cac5d48
-
SHA1
0ce76d19a602e58a8bb81d8baa5a609bc07647cd
-
SHA256
23b1660bc99b00ca748548de68ae4b9a3c42fecf01d572ba5075dde2c196fe0c
-
SHA512
e3ffdb3cb5caf743159e94e29d47848d7a6a97393703762a1568aa688d14695f7f5eda91ce07d2a1ad0af8741b80f826f8c3f61eff1b9814720c484b57ad5fda
-
SSDEEP
3072:C1rvjnrdU4KN1/iKlyLo8NJtikmH4SLN3HMIuobD4Ryi/OBVZl03pYe46KX:CVL64g1MLocmH7B3sI1rioc3pYeF
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2832 IEXPLORE.EXE -
Loads dropped DLL 5 IoCs
pid Process 1756 rundll32.exe 1756 rundll32.exe 1756 rundll32.exe 1756 rundll32.exe 2832 IEXPLORE.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vcroxm = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\vcroxm.dll\",GetSystemParameter" rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51CE6AA1-D29E-11EE-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414890660" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2480 iexplore.exe 2480 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2480 iexplore.exe 2480 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 1756 rundll32.exe 2480 iexplore.exe 2480 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 1756 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2696 wrote to memory of 1756 2696 a08bc8efa9fa2e9d5d2074ef6cac5d48.exe 28 PID 2696 wrote to memory of 1756 2696 a08bc8efa9fa2e9d5d2074ef6cac5d48.exe 28 PID 2696 wrote to memory of 1756 2696 a08bc8efa9fa2e9d5d2074ef6cac5d48.exe 28 PID 2696 wrote to memory of 1756 2696 a08bc8efa9fa2e9d5d2074ef6cac5d48.exe 28 PID 2696 wrote to memory of 1756 2696 a08bc8efa9fa2e9d5d2074ef6cac5d48.exe 28 PID 2696 wrote to memory of 1756 2696 a08bc8efa9fa2e9d5d2074ef6cac5d48.exe 28 PID 2696 wrote to memory of 1756 2696 a08bc8efa9fa2e9d5d2074ef6cac5d48.exe 28 PID 2480 wrote to memory of 2732 2480 iexplore.exe 31 PID 2480 wrote to memory of 2732 2480 iexplore.exe 31 PID 2480 wrote to memory of 2732 2480 iexplore.exe 31 PID 2480 wrote to memory of 2732 2480 iexplore.exe 31 PID 2480 wrote to memory of 2832 2480 iexplore.exe 32 PID 2480 wrote to memory of 2832 2480 iexplore.exe 32 PID 2480 wrote to memory of 2832 2480 iexplore.exe 32 PID 2480 wrote to memory of 2832 2480 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\a08bc8efa9fa2e9d5d2074ef6cac5d48.exe"C:\Users\Admin\AppData\Local\Temp\a08bc8efa9fa2e9d5d2074ef6cac5d48.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\vcroxm.dll",GetSystemParameter2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1756
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:406533 /prefetch:22⤵
- Deletes itself
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c931327286780b97cf5aa1dbb1207022
SHA1d2262c067d9da09bff8c285fdabacfda7a21a3f6
SHA256412ff2a9e99aff6b6ad281b7681177446712a8ef43dcc25728f530296295de23
SHA5122539efab4ff5360e16c9773d8e9c536779889400e2e2937442208632cea58ef1104568c2d363cde9351e2a90c757aaf45ec3d572f1a54813efa61183244e3c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596edc10ef133a165ae1cb0ed80a3ac7e
SHA11d9dc61ab12030c9c693a803bb9e4c1ae0cdd01a
SHA256c0a4c58ff8bc9f79c2fd33d637bc50e19a867cf8a7cb8cbce81f24a1fcb2c2ce
SHA512396afbb115796ea522737061346bde0546fe4b90f0d5e879c46bfb678ef32e5bd7b2c898d939f78a5e86ae433e0bd5a3498b88a71860a8000aebbd22a52915e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e459fc4845ab7f46b7fc4d615432c80b
SHA184b56923b7b92af2b80a6085229f2278798b317b
SHA256e9f0630345ba58ab3d62735d7b2c25da9a59b6a7691f3198ba7783cf9e2908bb
SHA51264d2683332942f0bae24abcfb189b871360553b08142a97a0f452281d68f90910b75092410f4edaf648cb8b7dbd47f5d80e1defd33bbf3889f891d30ba0b0fc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54be281aef0cba4178a0fada7f1a4bbee
SHA13f30be3d2ee7f0deab9976ab6fce04559973b94b
SHA25615bb7fa3007df50fd8ce121c17c10c3340cd4ab8e69e28c6a1110fe369ead001
SHA512b4c259981cb32875dc889cc92b878ca4ca18a39f27dbc1c71090169c2c67b506d5c7d8503e69152670506ccc7882ec769670bb1d36275095b59a497158913a16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0c1e6aa069dd92a8612bc4b91f45eb6
SHA189a1759bfe02da652cafc7af8c7009b7dd49d21b
SHA25687c1a30cb0ad8fda00fa87c2afab7b7366a3fe91680039f365ac4b3828c239cd
SHA512c264efc22e325bf5db81a2b714e16d1a9195f9ea9a188dacdeef28a1678e393ccb569c402bb484c90fc6353a8e42b8d42ecbc4be56e127915e9b240c83bc2fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51842ec3e4bcd8ddf942763e6bab38b8f
SHA1c29afda07eca3381e4d9c43a2c3242d0698950f8
SHA2569b3b135cf93a957aa6dcc3a8c9661ae25cb396325911871c8a053b90d016a830
SHA512df70fa9cf0219f7aead70f6108c87873a58bd2bce59da24f9ec8dd29b7bb1d4047e5ba375e321f3c7288b8d378cb01a06ae6d2be8b8c91bb24e0c7c103ed505c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bbd41e853ce901a86e9f412e7b849f4
SHA1d0159ea50e83761035c939568974e70aaff16f4c
SHA25651ef3445fa7f3918ef90e0150e596834275c3e0cf2a907fa54414ae07275771a
SHA512adb1cc325a9091db6ad87e1ede40790c077db84bcd88dae718ea94549f91eaf661256a450103d917e316dd7bc1e75bcb08913ea7cabf09a62131dc80264f32b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d243fc23896101c8b4bb13735d0605d
SHA1b83288081bb6ba389022cf482ac39023c0a56534
SHA25649a35852dc337af2c9d60713872d459b882fbf59073f8b36003589e12486bbd4
SHA5128e0f0fe9f5b331aca4421a8b0e2c88c760b5c2d3704c9416f5e2e01b36db01418836c530b5cce4a19403a360150bc11a3ec6c6eadb90b5b2255568af82825f7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f79c6b99b70da717abed948331cbbea
SHA1db266cc1f49c7eb5d8abe379aaf2c82d51e9d913
SHA25629f20c8eb6388762cc069d25d8150e576e70d283d9063c0bd7c552a27be8944e
SHA512d70457c37e7a7ca66f29eae2eebd59279c2e724c1006161dea995d7d3c9c560a06674d85db0d1f3b2a9603f0a79031aee9b038e19d1a81976779df3b62f9b5ad
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
173KB
MD54ca5b13266d90c3dcab042ea8cffc3b2
SHA14ac4fa43aefd45a551ef1bc6e5357ef88811e280
SHA256631b3e4721892a466d693bdb6e3fd992ca630c0ee9c2ae2aa97a37e2c5f1e1b1
SHA5126d07ab44e8bb86659de497a15a2fa4b491a2cfab5ad5a4d84815fe3b37fe12915947d1cb390406145b4f0d188a89711f36767443b7437b092c1418abb45c9edb