Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 08:55
Behavioral task
behavioral1
Sample
e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe
Resource
win10v2004-20240508-en
General
-
Target
e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe
-
Size
5.8MB
-
MD5
a97e66ea7095597de7d9b788b4f73b3e
-
SHA1
472b743afce38086cc082aa896c289a558559549
-
SHA256
e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36
-
SHA512
4aa27b38f08ecdad505907a3fe2fd10067e385fff1e0bc72b1cbf91950ebc64de8ca8858a49d72e91cc410597d898a94e6cb033d7e8ebe8e9286d97c35d11282
-
SSDEEP
98304:Vw//0Kco6MkP7Cgb5ii3Svm+RiHh2eHvxznfwgai/YQyz3zJYxwNwiwA7ou:6X9gb5i+EYHkeHvxzb1yewNwiw6f
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2972-35-0x0000000000400000-0x0000000000E90000-memory.dmp vmprotect behavioral1/memory/2972-39-0x0000000000400000-0x0000000000E90000-memory.dmp vmprotect behavioral1/memory/2972-40-0x0000000000400000-0x0000000000E90000-memory.dmp vmprotect behavioral1/memory/2972-41-0x0000000000400000-0x0000000000E90000-memory.dmp vmprotect behavioral1/memory/2972-42-0x0000000000400000-0x0000000000E90000-memory.dmp vmprotect -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422702824" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20703f5cb8adda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000b899db6b2ceddf909e790711dd1eeff41e916cc113deeefb009636f8d03f7c1d000000000e8000000002000020000000a073229a1ccf64050677502af59818d832ccc7e8e1a88735d4485e09a08af2aa9000000007079598ae280a881c79229baf885088cf4e5b44c462bc6dfa5cd054460f9f6cd21c67dec80a4c1cf169b3c3c83a0eac39c7e03dd6b20a4459e99310cf0489decee141dc233d60ddb28b23fd34f3c526ebc99ac18fd9631f73fdb97148c96f2f48cfdcd4315522de75edb66a3d6e7beb562ecd77da59baf7c33350a70b33d1770643b81d00dd53c8a306f1c91b2cf7fb400000007c69773692e9c7bde16a28e0b9f232506884a398ff668d564d11a634c5bb7921c62a2f4ccef3db9841dfa9c41096ea8e486174ee3c4e4047615868835cc9fea0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E41E141-19AB-11EF-8C93-DEECE6B0C1A4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000006a0561e9a1e9fb6ce2bc4f4382866be6beed3f9ce2db8563cc65097e2bab6b85000000000e80000000020000200000006fdf7ee0c2356d2bbc65c53d3a8904d13764a92b3e60427366417336a2049443200000000ab566e4ee7abb42e3296ffdc9170d73dcdcfe16cd17a72224a9829e190e00344000000051c824f5525c364d77887b7016e4b3675e72e6a6154b834a53673fb250ccc1be53220acbca47941c8824070502e01c637a10ca997d36074fd0cd1a4deab3eebf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2668 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe 2668 iexplore.exe 2668 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2668 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe 28 PID 2972 wrote to memory of 2668 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe 28 PID 2972 wrote to memory of 2668 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe 28 PID 2972 wrote to memory of 2668 2972 e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe 28 PID 2668 wrote to memory of 2948 2668 iexplore.exe 30 PID 2668 wrote to memory of 2948 2668 iexplore.exe 30 PID 2668 wrote to memory of 2948 2668 iexplore.exe 30 PID 2668 wrote to memory of 2948 2668 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe"C:\Users\Admin\AppData\Local\Temp\e360826a6e76ce38b10b2ae922232dc9526b3fde9920b3ab29f26ad4a9bc6c36.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xz.weimaocm.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9b29afabc9f6276bd23e72a2ecfe147
SHA19db85d16423d3bdf60d62e5080af8c373e6af5a8
SHA256071550e5ed561b5316944bc0f20c91f806be9e64ede4f253aa5102f320b1ed63
SHA512c16b1df4c7e9fb16fe5efdce3b3495ff80766dbe1314fd537cc2246d90f95151cb551f1427974fe8435a849d1940e15a39c703e8039d10022edc8fcf3b3dac63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f78470ba07b7acd037b4239bf571b78f
SHA107f69c9c99fd66065f6dfef1c5a128442226cbbc
SHA256d40bed77d8170987d7c645339e7a504c53bc67564d872f47ea9fc848fb31b4a0
SHA512e59005ee3464dc2017fc514c6b7319285d2782b3ace4c0b983b40d047a159e2349d42dd64e3e78b0bde1174cf8482494911b8e44813c258f6959e9d63b2c068e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f488e7e2976afdafb89e5b38e112e3ea
SHA1d6e29ed427b43c491060d9b6220157beaf531caa
SHA256379a030c9e148b4d6982899a42aa1f4e9ab71f6653723571a393cbfe551fe3d5
SHA512f8406f376892a3b1b7e44ff72fd40f00829b7aa9eae7e3f2ae15eccc140520eceb2a6ff59b8d80a29aa51659d82c0a8b5902bdb36f5860e91ac8d20eeda49be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52509fbb6e67d88d7f1c00d0ae5c46877
SHA1672fbb2323082b90c083bced2ef5a363f602e39f
SHA256cfe8c169f340808f6e5ff99684ecc1ae72cc8121d8a6895fe5b620c0ef30c8a9
SHA51231d69229cb2de92f3df435f526e8cdeb864a626c20998e1c7b9cbcc04dca567e22643fd2296f06b7d62250f4dfd2978914780a2123236d42220cac35d6248f82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3d949f77737e3f453a2c4d60bb48573
SHA1635d41f2decb5d972acbbdb20a9d2281ca8747cd
SHA256014c6c173206f7103099e692cec9ac89eaee8bb5c97d5a93da886f609ee4c760
SHA512e56465d2db3f8db9f7c9259fa1f647acb5ed272abfa6329629eb8c1f694276516350ce7d0c6f8d883720be08bb5cfa2491fa574d958ba164000c1078f26e1b2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b04aa00dc4ea6b76db21ff896905fdb7
SHA11aca15c678f31df5767a4de147692a5a246da53e
SHA2560bcef73ae374447fa4989ee5b74e56e2a901adc424452d5f98c15023084dfcff
SHA512a20d2f79d13f92e36e4f7ea41d983ff764ac46212043bce6d3b6862c2703117e694fb5ac96cdbd81c4771cf3b1222283d6b69ac79d8f31741a777ed97561f501
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a83d9adeb9677cac81294a6e26cf0822
SHA118b1f4fead13f98d630bf394eb3142e98cfca3ec
SHA256b91fabe0180164ec8088b7fa4a3792a81aa14dd4c21d7a348ef8e9a1739df859
SHA5121ebd6ad3bbf37d5ef39e612d521fb37d6b96d5a23485e786dde8834daa1e3f088b7115ca2da06a459cfa4feff7bcd4bc6ebbffa3dd34ce8789c168bdb7efa7e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573d5655382352fbcb943c8083467259e
SHA1f2d8c51d86d21c650aad497427040cb2a3998d07
SHA256b2aa42433cb2efe828f8a8350355268fb3aebfb35bf07e32a5c4c19419369d87
SHA5121f41a4c98bfe33b2df1e6c9577e90704199580b770cff933f6c9949a1b8a4cd87227b2399ac5c9dda29d35295ea1360bf96d92eb4f76ff289377a3551cae7799
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548fd600620d8afbf1479236bc2afc9b8
SHA1f4f93a36f6c05ede16332807392dd72f20679549
SHA2561b2cf6c1c07868c98558594b6ad40519dc057c75edc1f617c815ead24ad987f8
SHA512120e45749728188abedfc4fd5d61b16da029cd31d2ae93bf56c7ac16052fad0c8c9ef72da58092fa802be0c3a5221726267630d3d0a4448a30d8dfea8ef3e464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5358e3282ffd7d5d50a7e19c24faf1cbd
SHA1f716b745cc83e60285f44d91acf6cc14251efe5f
SHA256ed2d3e545c58c3e616ed79b93db9c4328e57517904b33bf8593e587254230693
SHA512317a54e180342fab87776658b387c81775f1a20d512831bdd42037a95f79219d4b7e1ddee11fa823d176faf488760186654365c2ede047891ee4c074d60dd282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d19d748b43d20d5d064120fb044afd55
SHA1533623de1b57dedf5988fc718326a6146e7cb012
SHA256dba52282100479d82ca732a3b643cc6e66b7163366a33f75e401df72500b2d5b
SHA51232c8f0eca48b0bf10c99c855188ffa2a3ce88df41554a1251cddde6489012a5fc0ec8e621ce4c86a9de97e201fc4c197c1653effaba1beb8947608574ad1fcec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ad9f3356f6b9b602f125bcdfdee5fca
SHA1901c4b84d71d769ee28c71c3d2f3895b6957bb4f
SHA2563b997bfb539fe2b293aa1030ced80551f17b92005d63699b715c690ace68e959
SHA512a9afa973e3d5cc8137c1237ccf3094bda7603892c278f6130cd92c4854c4c53dce8a74bc905902f75a9cc1ce97582eace2bbfc817cba66606d664dd57d35758f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575a5612b89cdd321e619ad94ac77331a
SHA188c9467c4b7a267906eb40002039f6c756f68c61
SHA2561c7e67648911a178065bc10f762a562559ffcf5632c92c6a24e1c27077bb7bc9
SHA512ed276875fbc54ac3120b665b327d9473bcb182ead3ecae7aa781afe9cfe71fe5ec906da36d3bbb0ef26cee1e80a6d16927286a489fa45ebaf4bf1f0e60621615
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a