Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
2a97878c38498fafb9eb7dec8e9c350c579a5dc4f7300a308ff0827b75cc58ba.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a97878c38498fafb9eb7dec8e9c350c579a5dc4f7300a308ff0827b75cc58ba.dll
Resource
win10v2004-20240802-en
General
-
Target
2a97878c38498fafb9eb7dec8e9c350c579a5dc4f7300a308ff0827b75cc58ba.dll
-
Size
1.2MB
-
MD5
08a64c8354c1c8eaf23c3f91d4a997f8
-
SHA1
2907f87669d8457d4b64bf82b77b7efc31026e07
-
SHA256
2a97878c38498fafb9eb7dec8e9c350c579a5dc4f7300a308ff0827b75cc58ba
-
SHA512
1119ad485f12c7218e7aec8f00368dc66e67ce915a1b71a7ab6607977e7e68a48f2f1a7140a5ed7503d06abed3fc8267774ab204eb34e0705fe8ec5d9fe55aaf
-
SSDEEP
24576:gbcRnQcEjaTnvmMeQncd3ToOKi3th5Tq+uU77AQvSEKrRgw:/uMPI3MS3tfTdY9gw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{528496E1-71AE-11EF-BA5A-5EE01BAFE073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000346519537ffed596056dead70321bf0d86075a44ab4d2f5b4b9171c45dff3be0000000000e800000000200002000000079ed6b3ce8aac6d9729b49c9a824f675663944943c00fa4773713487e7a042f52000000082b67bb19204d8884f4708239b682121b181592d6bd1e6bbb1e80d92df748e81400000008eb6184b6690d5b83928e190d308ce6f21508e77129e0bab6a7109f063d476a136f6d1f157d98156c614cf4775a6b321eb61c9d35622274f701bdf2f44bc52a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432379774" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000fc43f8b6844dfaaef362e209aea9a2fd1cc9096d5b4bb501ea0b5baede172a2b000000000e8000000002000020000000842e2e017c751dd8b50c19ffa57967ac5c3b44bcf26c983fa0928a598bbd2d96900000006875c673dad48a8b922d639813565de8a873459887d209246fca530e6538eecd5a3b477d68dc9aee23f900052550d989b1c033da4b6e9b3f5e52dcb59a575f857d26c634f5eebd647bf2ed158b741ae37c8e43cee642a4325a8fca8e6e4bdb674c7567f14cdb7948b496df808cb08ec1a3c0c2b3a12baea832ab238e1e096d018b3bcc6c8732f9e583745fac58b8e5f6400000007d3f9b79fd9e08652ff101235b757c4871d9d18a76ceef16c863f527a38d42471c1ec5a0ff0a983e221106b45e36bab2e0133b14d640ebdd6ff5bae4fd9e03c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002ad828bb05db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2856 2792 rundll32.exe 28 PID 2792 wrote to memory of 2856 2792 rundll32.exe 28 PID 2792 wrote to memory of 2856 2792 rundll32.exe 28 PID 2792 wrote to memory of 2856 2792 rundll32.exe 28 PID 2792 wrote to memory of 2856 2792 rundll32.exe 28 PID 2792 wrote to memory of 2856 2792 rundll32.exe 28 PID 2792 wrote to memory of 2856 2792 rundll32.exe 28 PID 2856 wrote to memory of 2916 2856 rundll32.exe 29 PID 2856 wrote to memory of 2916 2856 rundll32.exe 29 PID 2856 wrote to memory of 2916 2856 rundll32.exe 29 PID 2856 wrote to memory of 2916 2856 rundll32.exe 29 PID 2916 wrote to memory of 1916 2916 iexplore.exe 30 PID 2916 wrote to memory of 1916 2916 iexplore.exe 30 PID 2916 wrote to memory of 1916 2916 iexplore.exe 30 PID 2916 wrote to memory of 1916 2916 iexplore.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a97878c38498fafb9eb7dec8e9c350c579a5dc4f7300a308ff0827b75cc58ba.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a97878c38498fafb9eb7dec8e9c350c579a5dc4f7300a308ff0827b75cc58ba.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://t.me/+TcyFQQFcPIcwZGEx3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5496aa4fc83bd71a93b32611838dfa0ac
SHA1b76eab8e434509e9591f657b70476a48835f4628
SHA2568a7d079df98dd646fa5ae4e1e68437fce6d7cf66873fa78e1be2421bfd804f35
SHA5123d3b64b8e0aa212c9c459b83221343be7837346886c6d5b0c85b98b3985ceb380b10df8e8de7715c325092057a0ca21f7f65df70b5df4331e8913b2ce729812e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5f7829093f49db6527d3f9f13872ad8
SHA1f32674f676f100342cedbbabdc79c8b5133c987b
SHA256c3f52c188fae981ed9230bd4939ea4d6c11d974762ff2d6051435af573157e52
SHA512354a0139cf37ccd01d7d4d1286e01447ea5f066a70cc25a5e1ad16721f0777201c511eede71a772e9ed87d9e4e0dcc592a79ccaf5df41c97161ddb3f4cb9aa61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537df0c1f0dcf5b6001f0a5d478230767
SHA17e7b7d84144ebec0a7dd430aa66f72631507d4a1
SHA256e3bd2146352dba60898df1a0363262e6db89751231a181c82ca88825cd0a1e07
SHA512ef8e40ce46e825f42d7772ed5a453b1b86c7917c5d03a0400897f2062f852234f38878844bf2fa45d077f7ff93f402a48500cebf0e0a2e29c2472e5fd41437f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffc5a3e38cc27f154d6ad76677f57ff2
SHA13aa1673d49a10c747dd1154d6e625e46cc2cfeba
SHA25698239ad2574205f38c8e500cf63c99137306014fbb33679afceabd0e77020aa6
SHA512dd93523cf6a4126533004dd4b86df8b1b47b3324db2c85eca7c31b75f6f0bda310972f8e5009c7582961c8390669d8e12aab3dc936e8f711fe5bedee8c06ff2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5422aba67b597333a5237e90232fc6e52
SHA169767e3e18349e71dd8d28774f365850b71b5645
SHA2563f07f3b0be8981cd8dd96060d15427e90f7600a5e82b44ea3e2650476dd90a27
SHA512ff2a179dca40392d18308cdf701bd8372b254899f23346c0b427e340042e5d285efe228fff4a992d54e51a79e898323001653dd4d29938b5b337e611814f6cca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b73bca907b22fb325b7d879237828dd
SHA12983d026a65646d3b64ad31df6079591d9562ddf
SHA25630e2ff90c723e1ebf5fc0be4e10fb5c95891ddc027cf8df97a34a452b2efb7e6
SHA512b23ba2c6664fb2d5fc1ca179ee0aabd971029f0d2753c74ce156354a6925431920276e75a937856311bb1340ce8824b3f66fedc5242fbf3dbbf3072429d37ac3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c658afbf52c9fae8f927a9c1efe2fc9
SHA19290c5bde09afa4417cf37ecf110d6653c796c52
SHA2562ccaf975f4c27ce8e6d5403d190dda0b3374397eec1a1d80b1652b65d4deb55b
SHA5123e02713c70873d1f62f902aced0919fe8291875621360bbfc5b9bca1256a181cccdcf0eff8ac3b227f67d63e8c230b0b3f1a3be70cfa2465694f7e9a814d3d12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df920f8ad92c42cb559ae40d635b9da6
SHA1dd71e0b53ef9cff44cbcac335a12e63cb9bfdb56
SHA2569b3808a6b60bc6f5511aeeccc81f0dfb64c9a03441d6bec88cf00b9529c921f3
SHA51287ecbff307b1cd21343c48b4911b5a792f3fb8a4f8d6cbb3c888d28ffcdf0b0b20888425c5d2cf15769fe17088645a0b2f92e2a474296290ef5e935b35156d4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f716e5422e5e87a00b6f0af325c5e60a
SHA17852b0363dd7f630536f52a13f01cc738bb0ca24
SHA256088a70e94d4d622c7855cbf1a8ad5b6f0a2f237e6a6b8ef8aa87fae1bcc2f283
SHA5124f5331f7ada54532d5e13d59816b0be57a7b1f90f4b03d77f77ce7099a78038b4aec756035088e3c9ae095d17cb6cb5dc7ba7c56089ec6719e4ca5061683110c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5854b2c2753f2081091e9b78a023b29c1
SHA1d23067ca51cbbb72201627710a04797a9d09b333
SHA2564922c99219e53c36c61c9bc6daf2d60e39669c31a39517dcfc0b6ef0f9785077
SHA512eb70858a195f6e4acaee6116e7af11707576beb4afa9ea050a5c12520ab5535761f86a6b45e86342cc5d2e54a51b4faf7eda21b42238a231347201b60f77ad45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bda29c6936f4577aee7b05b0c5eb513
SHA119837f3e490d63366311219358d81d18710853c9
SHA2563e51f0a9657d2fcb10f39d131a94974ec1a16f3621740c1e6f071c939c6d4c2e
SHA512bc185db9152bb382dd3b1cbc12a0c4fc57c8b644c8e2ba5d6abdee5b3a14746512240853a201df50df0244e35e3422f68a85657e31da1e976b19c74a74b80ab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3e2f615bd654aa4458b20e1afe49abd
SHA19654230151acecbfcb76712ca840c185640d862a
SHA25686805ba48209e54fd6c9830becb44708a04fc5bce0b0ecdde3c51ae3093b491f
SHA512afa066b4a8a4943fafc419cdbe79706f6476e8815fc200bcb6b2850c16b5dc9cabed17ae12e2e25c2c4488855a83f4f3cbc39f7c650057e37c9a60fc170fa9ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e61fc7262360ce9d801ed172b3f2178f
SHA13c769de0e97613281e1706b5eee6b61f08034600
SHA2566dfc18888ab430a711ca4ab6b014c25d8238c00ff31248f0139f809ccd8f326e
SHA512df5b47158eab4affaba13da44c74dea5b8ffa21399ee4565558d49339ddf8bb62a8e9b7f0a4820277ca5b1e68ce102001eb52c035972f93dcfc57691565988de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f497b8bcccfa424fca9cce3d354cb5c
SHA144d090b7e3d3617893057242e02f6415d91231e5
SHA256cff2450dce3fb8706332e9a86af2855459fa193de52c1be4190970a03086b994
SHA512efc60795f773c7d48962593ee5edb963f61715d3574ad4c25b0992a637c2e8d14a51f9e7681832178207ac6eeb4be7d8a809c592584abb4880740f3c3215f0cb
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b