Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
322s -
max time network
316s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 15:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://isaattractions.com
Resource
win7-20220901-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
http://isaattractions.com
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
http://isaattractions.com
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000000d0d40f0261936652011ac793f80c8d0f15fda31a701daeed6296ea243034b87000000000e800000000200002000000031df758057fac93423e0b92a4282b892858ad1e5a93ca4696a0ed9d5198090b520000000c98a1c021266e8e1424faec09fa52bd877b07d8456115cc3dd8602fcce6af10e400000005c3dd8e2f9f828049044212fd96a48a91995e7d25659fd67a39b7cc4c9657bfd4f3366c797d4c3f469864f2cca1fcca612ad8fcc1f8cbdfa55d36eeaca354a2c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0dea7a6c8f2d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995144" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bbd4a6c8f2d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2464250040" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2464250040" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374604567" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995144" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2464250040" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30995144" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2464250040" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30995144" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000162d38cc67d4d906e9f743ca0c4b01eeb8794687c41003a5fa009ee55bc09e06000000000e8000000002000020000000a72e235d3866811afcd720c5c049b9f0d9fdc91de49b404a21a7b47e4347000c20000000e6f4a120eda426ed78a4e970a9efa0d53fb78d82cd57bcc5e3e48acd1cc3b4df40000000d041f28a987c196c3e0fe4e56b649c0cfcf6cef49d65b06d6f2bb4f99ce13934da12a91551b065931b5c7e829730b64e060f54ce2795e6c38bf48baf1833bf9f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BA5AC5D1-5EBB-11ED-B696-D2D0017C8629} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629973501-4017243118-3254762364-1000\{FE6F4424-1072-4E62-9391-27442274BDC8} IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4856 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: 33 4388 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4388 AUDIODG.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: 33 2080 IEXPLORE.EXE Token: SeIncBasePriorityPrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE Token: SeShutdownPrivilege 2080 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 2080 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4856 iexplore.exe 4856 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2080 4856 iexplore.exe 81 PID 4856 wrote to memory of 2080 4856 iexplore.exe 81 PID 4856 wrote to memory of 2080 4856 iexplore.exe 81
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://isaattractions.com1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2080
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x480 0x3001⤵
- Suspicious use of AdjustPrivilegeToken
PID:4388
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD54ac2167e51e17c7abdd06b4a0c6ba4ca
SHA1d853f3d325fbc00fa030eeb0fc1385881414e4c2
SHA256fbdb7ac33877bc8f2724f838b2ba2ed5093a28209476b1033406875de3cf54e4
SHA512759b2c9b1bcfda84158e1662ae09b50ac4889b5a720c8f4dc58ee02ca3168f02bc23d99289bba01b6d71353b656092a6c18469360f2ae40bbe12a0115399809d