Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/07/2024, 05:13
240706-fwdgqayfmf 106/07/2024, 05:09
240706-ftk4sawekq 106/07/2024, 05:08
240706-fsqmwayfje 4Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 05:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://http//roblox.com
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
http://http//roblox.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 32 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78213091-3B56-11EF-880F-D61F2295B977} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1496 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 1496 taskmgr.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeSecurityPrivilege 1296 winlogon.exe Token: SeBackupPrivilege 1296 winlogon.exe Token: SeSecurityPrivilege 1296 winlogon.exe Token: SeTcbPrivilege 1296 winlogon.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeSecurityPrivilege 1296 winlogon.exe Token: SeBackupPrivilege 1296 winlogon.exe Token: SeSecurityPrivilege 1296 winlogon.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeShutdownPrivilege 2180 LogonUI.exe Token: SeShutdownPrivilege 1296 winlogon.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1668 iexplore.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1668 iexplore.exe 1668 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1936 1668 iexplore.exe 30 PID 1668 wrote to memory of 1936 1668 iexplore.exe 30 PID 1668 wrote to memory of 1936 1668 iexplore.exe 30 PID 1668 wrote to memory of 1936 1668 iexplore.exe 30 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 1296 wrote to memory of 2180 1296 winlogon.exe 39 PID 1296 wrote to memory of 2180 1296 winlogon.exe 39 PID 1296 wrote to memory of 2180 1296 winlogon.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39 PID 520 wrote to memory of 2180 520 csrss.exe 39
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://http//roblox.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1496
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:2520
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:520
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:3032