Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
80s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/10/2024, 23:34
Static task
static1
macroupxaspackv2macro_on_actiongeforcehoststealerguestmydoomdarkcometnjratmodiloaderremcosrevengeratwipelock
21 signatures
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master/Ransomware/PowerPoint.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Trojan/LoveYou.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Trojan/MEMZ.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Virus/WinNuke.98.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
1800 seconds
General
-
Target
The-MALWARE-Repo-master/Trojan/MEMZ.exe
-
Size
14KB
-
MD5
19dbec50735b5f2a72d4199c4e184960
-
SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822
-
SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
-
SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
SSDEEP
192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Kills process with taskkill 1 IoCs
pid Process 680 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31A1DBA1-91A1-11EF-BA23-C60424AAF5E1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000cea0755a3dc2521ac3a4eaae6920b7756cb5cf5d6688d6a95cd7f3da7cc28013000000000e8000000002000020000000b4e1bfd1e28bc2888415fa20cf833d4da533285fbc226bde15435a8ece3f6a7120000000578d9861ac06b326027e65ad8f73692553afd2f54f7be21670ec7be6c61bc2bf400000003b590db39161265123fa00b08a2cc6af884394642c7a80c64a207d0413a49643fd574b49ab38b8dc9341a6a802e54387a6ff00895f1a3260f40ff6e1e9175c86 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60709e08ae25db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000cdb8a4d5d2e276d15ca9e1f8abb76f801d467cbe684208fac883f03cfdd10091000000000e8000000002000020000000df56cccd7c2407faecf6a5063ebf03b152374f88b07fd50438e186e5483c614e9000000093591ab428cbac25817089a3462f150a4ecb4189748b6794c99c21e61a539c60365fc46b60660b1990409307a026e97dfd2403a8c27c77cb3a334c273b6bedc6f6f3299911222897953cf99f905b5b7b29888511253380e4568453f8a119ffd3115e298ddf4a4be2623aa21c14c8482dc4f2dc869b2aa1e6db0b50243482a1db7ede61aa6afad380b79a824751f58a7b4000000036a8b73600e86edd536242ab906e8ce31f83c5e00da84b3b983616df89e96063a89d64ff4e4999f284f95e8d25bc353e98b750053c179c9f9de456ccb2093dd3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 MEMZ.exe 1628 MEMZ.exe 2452 MEMZ.exe 2436 MEMZ.exe 2484 MEMZ.exe 2484 MEMZ.exe 2436 MEMZ.exe 1628 MEMZ.exe 2784 MEMZ.exe 2452 MEMZ.exe 2436 MEMZ.exe 2784 MEMZ.exe 1628 MEMZ.exe 2484 MEMZ.exe 2452 MEMZ.exe 2436 MEMZ.exe 2452 MEMZ.exe 2484 MEMZ.exe 1628 MEMZ.exe 2784 MEMZ.exe 2436 MEMZ.exe 2484 MEMZ.exe 2452 MEMZ.exe 1628 MEMZ.exe 2784 MEMZ.exe 2436 MEMZ.exe 2484 MEMZ.exe 2452 MEMZ.exe 2784 MEMZ.exe 1628 MEMZ.exe 2784 MEMZ.exe 2484 MEMZ.exe 2452 MEMZ.exe 2436 MEMZ.exe 1628 MEMZ.exe 2436 MEMZ.exe 1628 MEMZ.exe 2484 MEMZ.exe 2452 MEMZ.exe 2784 MEMZ.exe 2436 MEMZ.exe 2484 MEMZ.exe 1628 MEMZ.exe 2452 MEMZ.exe 2784 MEMZ.exe 2784 MEMZ.exe 2436 MEMZ.exe 1628 MEMZ.exe 2484 MEMZ.exe 2452 MEMZ.exe 2436 MEMZ.exe 2484 MEMZ.exe 2784 MEMZ.exe 1628 MEMZ.exe 2452 MEMZ.exe 2452 MEMZ.exe 2484 MEMZ.exe 2784 MEMZ.exe 2436 MEMZ.exe 1628 MEMZ.exe 2436 MEMZ.exe 2484 MEMZ.exe 2452 MEMZ.exe 2784 MEMZ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 680 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3044 iexplore.exe 3044 iexplore.exe 496 IEXPLORE.EXE 496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2784 1972 MEMZ.exe 31 PID 1972 wrote to memory of 2784 1972 MEMZ.exe 31 PID 1972 wrote to memory of 2784 1972 MEMZ.exe 31 PID 1972 wrote to memory of 2784 1972 MEMZ.exe 31 PID 1972 wrote to memory of 2436 1972 MEMZ.exe 32 PID 1972 wrote to memory of 2436 1972 MEMZ.exe 32 PID 1972 wrote to memory of 2436 1972 MEMZ.exe 32 PID 1972 wrote to memory of 2436 1972 MEMZ.exe 32 PID 1972 wrote to memory of 1628 1972 MEMZ.exe 33 PID 1972 wrote to memory of 1628 1972 MEMZ.exe 33 PID 1972 wrote to memory of 1628 1972 MEMZ.exe 33 PID 1972 wrote to memory of 1628 1972 MEMZ.exe 33 PID 1972 wrote to memory of 2484 1972 MEMZ.exe 34 PID 1972 wrote to memory of 2484 1972 MEMZ.exe 34 PID 1972 wrote to memory of 2484 1972 MEMZ.exe 34 PID 1972 wrote to memory of 2484 1972 MEMZ.exe 34 PID 1972 wrote to memory of 2452 1972 MEMZ.exe 35 PID 1972 wrote to memory of 2452 1972 MEMZ.exe 35 PID 1972 wrote to memory of 2452 1972 MEMZ.exe 35 PID 1972 wrote to memory of 2452 1972 MEMZ.exe 35 PID 1972 wrote to memory of 2760 1972 MEMZ.exe 36 PID 1972 wrote to memory of 2760 1972 MEMZ.exe 36 PID 1972 wrote to memory of 2760 1972 MEMZ.exe 36 PID 1972 wrote to memory of 2760 1972 MEMZ.exe 36 PID 2760 wrote to memory of 2832 2760 MEMZ.exe 37 PID 2760 wrote to memory of 2832 2760 MEMZ.exe 37 PID 2760 wrote to memory of 2832 2760 MEMZ.exe 37 PID 2760 wrote to memory of 2832 2760 MEMZ.exe 37 PID 2760 wrote to memory of 3044 2760 MEMZ.exe 40 PID 2760 wrote to memory of 3044 2760 MEMZ.exe 40 PID 2760 wrote to memory of 3044 2760 MEMZ.exe 40 PID 2760 wrote to memory of 3044 2760 MEMZ.exe 40 PID 3044 wrote to memory of 496 3044 iexplore.exe 41 PID 3044 wrote to memory of 496 3044 iexplore.exe 41 PID 3044 wrote to memory of 496 3044 iexplore.exe 41 PID 3044 wrote to memory of 496 3044 iexplore.exe 41 PID 2776 wrote to memory of 680 2776 powershell.exe 43 PID 2776 wrote to memory of 680 2776 powershell.exe 43 PID 2776 wrote to memory of 680 2776 powershell.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:496
-
-
-
-
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /im memz.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0976123cc6cd314d179bcd558f4579d
SHA19e0df4371a89f8ad03e11ce25cf4e5158780d655
SHA256b8f62d05458f8d45ae63f85ed5c1e68cc0e90d64e0f49a3df67b9822516d9a17
SHA512f99c34555c2dde69306f8ac4d69d398b2e7a32d40abd2f250ed861fe6c2227546228284ec853961d346f4043ad817544faeb597a607e7e2a6cee3d51bf043202
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adc256ada6ecb4806a89c2808e235355
SHA13c2bdd5f09490436065f342bce76d10ab0a251ce
SHA2566f0bb836dbfd81ffa5da983ba9d2c87dfd54effce18dcb0d0ed90101424fc26a
SHA512fe328d49d9c8753098e4f299ecbdd37359f173fd40a709ed83af103ec3b9eefeeb4efb8b3c0e1171a78cab52ad093fbe6d866cb41ecae4b439a511c1ff43d30b
-
Filesize
5KB
MD540ccb71407cb9c609065d661aabce5bc
SHA1c499ec54f04201c0c3b7867144a2a25d73b23aa7
SHA256877d4583008a4b0009f204f933743eb05be435d750b4d25aba7108d7ff60107f
SHA512a7961efa655d5bf58fead76d99b524a5d2dd067a6886e986301b5a9c07867e6864702ba781215863ac3be7b26e00fcde24c8312e299b59851b412fe581ebec66
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf