Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
109s -
max time network
114s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24/09/2022, 15:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://amogus.com
Resource
win10-20220812-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://amogus.com
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "370822442" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370805848" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30986299" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4215287692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30986299" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "370854433" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30986299" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012068ee23372fe41af7eabde7907acf000000000020000000000106600000001000020000000d9127b9289f504c14f9981f5382572542dd4abfeeb366db47b8139852dbe93ea000000000e80000000020000200000000a7c465c0909ad35196e25134a27cd811939021564e25f329b5dfc2d3c4b8eba20000000487e7e5fee35bf4f9f134d0d0531eb8c48a5e9f72ead53ef8f10b121f1d3b6bb400000008383584835e5181acf6af1d7483e82e574744b351c6de77c6fc67c09be7eade76c0b89ccd252a8e3c24416d43dbc5a399f01fb9631ef5a32121c683cac33913a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b973fc3bd0d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105b84fc3bd0d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4215287692" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012068ee23372fe41af7eabde7907acf00000000002000000000010660000000100002000000011c5ebd470404589588cd3d7ef08f2d44c6dd5b0a6b04556e3fef2837e4c6f33000000000e8000000002000020000000e9ec301d2b1d0556b14fd39b2b140a5e3de0b6b9b77557534d3e1ffae47e6f8f200000008e7e25e6d7412592a42357bdd910ced06042c564bcb7832e89cddfa5e76b359f40000000de22ae44e7a51fbc821c4dabddc70986aa20c0c82a0477612ec925e84f337b94a6d02a6ac2a3cd57212012ed82e190bac206ca762b589e436b14c5b024844dfa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26812885-3C2F-11ED-A7A3-FA105A7C9F51} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4223413247" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3576 firefox.exe Token: SeDebugPrivilege 3576 firefox.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2688 iexplore.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 2688 iexplore.exe 2688 iexplore.exe 4948 IEXPLORE.EXE 4948 IEXPLORE.EXE 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe 3576 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 4948 2688 iexplore.exe 66 PID 2688 wrote to memory of 4948 2688 iexplore.exe 66 PID 2688 wrote to memory of 4948 2688 iexplore.exe 66 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 5060 wrote to memory of 3576 5060 firefox.exe 70 PID 3576 wrote to memory of 3824 3576 firefox.exe 72 PID 3576 wrote to memory of 3824 3576 firefox.exe 72 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 5084 3576 firefox.exe 73 PID 3576 wrote to memory of 4236 3576 firefox.exe 74 PID 3576 wrote to memory of 4236 3576 firefox.exe 74 PID 3576 wrote to memory of 4236 3576 firefox.exe 74 PID 3576 wrote to memory of 4236 3576 firefox.exe 74 PID 3576 wrote to memory of 4236 3576 firefox.exe 74 PID 3576 wrote to memory of 4236 3576 firefox.exe 74 PID 3576 wrote to memory of 4236 3576 firefox.exe 74
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://amogus.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3576.0.1688986723\1469216736" -parentBuildID 20200403170909 -prefsHandle 1532 -prefMapHandle 1352 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3576 "\\.\pipe\gecko-crash-server-pipe.3576" 1612 gpu3⤵PID:3824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3576.3.1830388395\1216443774" -childID 1 -isForBrowser -prefsHandle 2260 -prefMapHandle 2256 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3576 "\\.\pipe\gecko-crash-server-pipe.3576" 2272 tab3⤵PID:5084
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3576.13.887046530\257862503" -childID 2 -isForBrowser -prefsHandle 3480 -prefMapHandle 3476 -prefsLen 6938 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3576 "\\.\pipe\gecko-crash-server-pipe.3576" 3492 tab3⤵PID:4236
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD507149bdd639826419e083a26419257c2
SHA1a8e6f0b4f6fc6e51803f4c9e46af728969de3f67
SHA256ebbe45f802e0679a14fc030c6cbcfa453183b54d5f26e7f26b40b377f97598cd
SHA51279630d054c2da35857dae03406e467294128a69fe4e0ccf10976e3a2d01645f2cf6ce5b1b90110872d04ee82dff29103e8e14439ff38c6309ec84fcf171623ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5de80af6c66bfed9688f9b54d98073e5e
SHA1723f2bceec8b2db90d13e80db2e423e906972b55
SHA256a44ed5e2fd2a480f4f514ea05f17832974513b262d84ad4867a53a44896b0ab7
SHA5123b059cf490cca5724925d3298e2cd5c3088ab8054caf5eef89cc45c3971334b6ad90603a953888ec0f883bdfb641ffc26f3c2825d915fc596e26366ec649adda
-
Filesize
610B
MD5533d5adb019101e95d9c52d1f0347412
SHA1cb54d511140384306e98c6c68ba65ccb8dba58c9
SHA2566d6b86d2d8792511b272820cf57524968f9367a0cb82bce342c315e50a3001a1
SHA5128bf852d628048b1fe8896baccfafd83c2ab0d20d54dddf12ccd982f53bf3e203991989e2946dfd364b6e7cd1a50f5d0360579d5fc9646e571ec65bf4fef239f4
-
Filesize
610B
MD5ce5285dbb4768de802bb35fa2106477f
SHA1b2c549a17ccbec47bf60384005f81ae5d2576ebe
SHA256e0a2fb6f22068ef6bec036985674d7d3e31f4c0135b769211eb440ac55cccdd2
SHA51213aaa45781ef4125eba470e4d8ba954552fa3a18ee64c775f852b64bc03524793c188e055a3e60d24f301236e73142972ac7bd94a98365317a7f6532b8545f7e