Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
79s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 19:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://y2mate.is
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
http://y2mate.is
Resource
win10v2004-20220901-en
General
-
Target
http://y2mate.is
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddaeacaa0afcab4dac877429aee295de000000000200000000001066000000010000200000005b048e44857e3baab1434cb9a6bfb2bd82cb86df6ea6b4ed686e1c0ffc13da18000000000e800000000200002000000097757e51a090bbfb9cc83d1b26e6386a934dded38094b0445be0ff61c18ecb7b9000000057e9aaedd5f7829fc765286c6bf24af3083752e3fc0937cb698ec4f88453e69e06a81ee90245bcc17606b088ead6c7ba963df85d5467419af7e17bf5c44e860e2e87cbacb207afbc03342e764e1c7c5672544f243040335d86dc9b7968874e124816dee79450dee5f67ffb4a679bfed4a595d81cf755228ba92ae6c4546404e201bc04b8bbe17ff648f60cbb0a4cb60d40000000c546a0c0829b9295c74e1013183e27813ab6b3e69b1be0827804b5b348ba2f427a34751ecf6acac3476f4b1c26a6f709a1582ea49d070927bcde68b8373e8882 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b7e44ae9fdd801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E86E811-69DC-11ED-9172-7ADD0904B6AC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddaeacaa0afcab4dac877429aee295de00000000020000000000106600000001000020000000e5a7150115c9168144d5fcf962479d82cc500d14d5cf22d1e3a7f0be8e7ea672000000000e80000000020000200000004fc546e6bcbdb83bc17e47ec804832bb28290b95d70f28bac7525e55754e9f16200000009532ed8d49a18870466e9854b7037faab02f0ae7fd701d5a73682611049aaa44400000003a701397f30b45a00f0dc2f688370beb297b68ae50496245d394463ef50619d6726da6617d0bd8536a04511eaaaa0c2694d0cd34972263f7801125abc8e4a33c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375828074" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1440 iexplore.exe 1440 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1440 wrote to memory of 856 1440 iexplore.exe 29 PID 1440 wrote to memory of 856 1440 iexplore.exe 29 PID 1440 wrote to memory of 856 1440 iexplore.exe 29 PID 1440 wrote to memory of 856 1440 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://y2mate.is1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD5f74ccf16d555237b198c3b12844f42ec
SHA1043df1cb5d4ed4f9d00d280a621ef44f58a78d97
SHA256be1451b587e46cdb1a8ffe02ee6c77c2a51a8f5a8679ab63bef3006abe00e86f
SHA5126bf0b694874f1e462b24cbc822c56d2d91a59b4a38aeb250cf5913ddf694df462e6b55d8bfac5e2bdb7e14b2c939cab5fa48c566445aaddb832dff621c1e5be6
-
Filesize
5KB
MD5cd0c70f87b3c15b0778c20dae8e8f045
SHA164a6658550490ff755dd59e4f7117e19c5b95a4d
SHA256d970721a04e04c70a4b9191ed0ffa61275478c5d02f0df34bc5509e13fad6793
SHA5128a8253a410cf76f9b180b0a8993cb806b2a7d75dbbeefc272e2de247fe193200fb5fe231c1f8c234cae890c18098a28a09f9564cc7866456643c019f5963830f
-
Filesize
608B
MD588b237d12dea84a1b96a94ebde366956
SHA1be574f5eecf810b31bea5772cfc235becfcd779e
SHA256adae00f5081dc429302f5f14527e95434b18f30b22fdb9ea5131bbf81fc34dfb
SHA51200d633f72af4d50c8aa26ddd93e9ca94e8024f95ebaee07da3f0d8a310cdf61c412a42292a3c0ac8eb26961ed0a72d5f15ba3a3fde43241e9a0fedce2312a4a7