Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 15:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cl.link-ag.net/click_product_link/20ca3c/24e91216/?redirect_url=https://relayhere.top?e=YnBldGVyc29uQGV2b2xlbnRoZWFsdGguY29t
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://cl.link-ag.net/click_product_link/20ca3c/24e91216/?redirect_url=https://relayhere.top?e=YnBldGVyc29uQGV2b2xlbnRoZWFsdGguY29t
Resource
win10v2004-20220901-en
General
-
Target
https://cl.link-ag.net/click_product_link/20ca3c/24e91216/?redirect_url=https://relayhere.top?e=YnBldGVyc29uQGV2b2xlbnRoZWFsdGguY29t
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372273243" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B031A6D1-4987-11ED-A23F-FE41811C61F5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\hcaptcha.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000009b1f41a51a482e7111003e01435008f673d219df2de7ab63df4bf3cab22a1923000000000e8000000002000020000000dcbb6ace56810aaf0a9df9957329a7523eb75545470e36394713609ce4da7ce020000000472d33661796b7044f91ee9ed2999c83f189c7a7f392d7fe8d7f812e70e297b8400000008c7b90a2723f3b0237ab24f854abc945173192592b5978fab01af7b54791271915652b5c4184cc2e2687c571861b393c9fd2dc9c6e40883cc4902b88ca0b1f53 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000c4ac91df53b7d8a94b858c7c428d2e5f3e238d750d86e25ba266c7b3de4aca69000000000e80000000020000200000009d77d4dfe54ab548721750358b3f063dd9eb884c2a64099ddd5fb72760d72bff90000000a881860595a06f7d1fc868ddeac1a5818211a6041e6d27a18462fa273bcacf2e5d50e7de3dbd36c73100aced3299decf6dda0b735c6357437cbf43b9e3aec7f06f531d633be209a8a5210f97fad2d9c62e8cbe8325c4dc87435c856ff9228d1cfcdf5e7aa908b3c12f116b4e163d8a163a1fa774fc4f999f0d75632e459da0f66ae13340c1e85610d5f3e0be90423d2a400000004a9f130b86f2a5fd7619e797c192bc1beb6216cfd604a4b4f01a2f55b209948ffe24158bf5f51d0396308add967d93c6578b1ef31547fcf25cbd85ccb372d2ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\hcaptcha.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f09a9494ddd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1672 iexplore.exe 1672 iexplore.exe 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1092 1672 iexplore.exe 28 PID 1672 wrote to memory of 1092 1672 iexplore.exe 28 PID 1672 wrote to memory of 1092 1672 iexplore.exe 28 PID 1672 wrote to memory of 1092 1672 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://cl.link-ag.net/click_product_link/20ca3c/24e91216/?redirect_url=https://relayhere.top?e=YnBldGVyc29uQGV2b2xlbnRoZWFsdGguY29t1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1092
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e89f6b4852bbdfecb505edc1101933d2
SHA10b0178d9ac65d6137b54c2020b5248d6caa628a5
SHA25684ccf40c7975a723089e7f141df3655133f832678e77f1b3d71b055cd4ee5a98
SHA512cd82df35217ab9ac0bc65f0e7e5cf5a22e6c7cc8a3ad22b4cc8b012c7088ceba474f768afd2c1e9ad01e3448f90f57bf12b447ca5f0ace3d437eb9a3e9642a85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd4c7cc59a55743ca4826ba9f98b2134
SHA135e7937b57e7b4870f90cdd88d4ee5aadc65edf1
SHA256c06c3a92e70ab889629bf8a93b9c87feed3ad621d8767749bfaaae88ca76354f
SHA512607bb78a4462d730a6d1e0851584def3eba1dbc105b8a1c3510008498a08415dcd3af8a56b45c7c9409473d7598ff74b76859e6a370d21bf5b4d20ab403b3b1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5bb5eb7aefef4b5130787db93d0cdf804
SHA19f4c00ed67f108af638404d901ee6d8064006363
SHA256e3faaca50d0ffeb36666d4da8a40fccb2ff99e12a13de5fa957f7feadc384f97
SHA51271a7dd438d66ba93e9bbfcc2245bef0a122bdb599789a29656397e1b3164b874f466290e73b3894a025e34e8032428ddef9002ccb33835028add706f6affa35f
-
Filesize
606B
MD569fb77eceda5b6c445cc82e283ebbe06
SHA1e6cf4a3f6c0a2824fb58cc7808eba1e84207c57c
SHA256063bda2168f2d9ef28136e707d56844e63083c564b6e4c2eb779d3078144f520
SHA512576af44d31f57cbeabefb2c74d97359156ddc12d0592cf2774b85817266c0a6c3a0a0e8579bee28c7e3927ee5e67a685f744d7bd59f7bb6c74553f855b47bb0f