Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2022, 04:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://links.twiliocdn.com/ls/click?upn=3kZIcBV84MSbPEonqfrF6dGb3PJ6jbldw7J3yS57HqemXns2WYta3RoHKq8W8aC7dpcuZO6hV88bATZHBHyDHuPY8Ti9l76WpI7y7y0-2B0tfTn8Gz7zrrkV-2FqxZGEI1pUggRA5KvZyNDlgUTGzsSR5rFfvu49i4FzNZBEDTmqSXLz-2BjS-2Bjf-2BB5X3MM28mG5mqN33bPAsfcGzJkVOBS-2Bi77lmHW-2BqyMM4w6s-2FBmRYFZJwc-2FQSdBAtKYDuQNtode72oF-2BMITl51YnqWhGyvO20o-2FgKHYhn9uVuvlSoek2hZYtD-2B-2F98Mu5Xm2Tz0-2FUIItjKvjtsY_25yE1MSaF2t4Ef21OWLU937Q4MctB958zt48B7-2Fz705AW6RPC1OO-2FOtHRBOPrp0ftlhcq-2BLLFeNMaPZXnmJezAwWAADYQPilh7PUkufv4oX2kmmZMGJZwP0NkmL3tftxzrvioCtYHhFT5OcI-2B5qPyVtyW8fDgQSZO9erPYFlO0AHul9Xpt-2FWygFIiS53ZNxpeJ5UNjr9umOoL6SJIQm9UyWN4XZEiSLudEkLt5B4UgsRiyvqO4REK4RvVC8zu7xv
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://links.twiliocdn.com/ls/click?upn=3kZIcBV84MSbPEonqfrF6dGb3PJ6jbldw7J3yS57HqemXns2WYta3RoHKq8W8aC7dpcuZO6hV88bATZHBHyDHuPY8Ti9l76WpI7y7y0-2B0tfTn8Gz7zrrkV-2FqxZGEI1pUggRA5KvZyNDlgUTGzsSR5rFfvu49i4FzNZBEDTmqSXLz-2BjS-2Bjf-2BB5X3MM28mG5mqN33bPAsfcGzJkVOBS-2Bi77lmHW-2BqyMM4w6s-2FBmRYFZJwc-2FQSdBAtKYDuQNtode72oF-2BMITl51YnqWhGyvO20o-2FgKHYhn9uVuvlSoek2hZYtD-2B-2F98Mu5Xm2Tz0-2FUIItjKvjtsY_25yE1MSaF2t4Ef21OWLU937Q4MctB958zt48B7-2Fz705AW6RPC1OO-2FOtHRBOPrp0ftlhcq-2BLLFeNMaPZXnmJezAwWAADYQPilh7PUkufv4oX2kmmZMGJZwP0NkmL3tftxzrvioCtYHhFT5OcI-2B5qPyVtyW8fDgQSZO9erPYFlO0AHul9Xpt-2FWygFIiS53ZNxpeJ5UNjr9umOoL6SJIQm9UyWN4XZEiSLudEkLt5B4UgsRiyvqO4REK4RvVC8zu7xv
Resource
win10v2004-20220812-en
General
-
Target
https://links.twiliocdn.com/ls/click?upn=3kZIcBV84MSbPEonqfrF6dGb3PJ6jbldw7J3yS57HqemXns2WYta3RoHKq8W8aC7dpcuZO6hV88bATZHBHyDHuPY8Ti9l76WpI7y7y0-2B0tfTn8Gz7zrrkV-2FqxZGEI1pUggRA5KvZyNDlgUTGzsSR5rFfvu49i4FzNZBEDTmqSXLz-2BjS-2Bjf-2BB5X3MM28mG5mqN33bPAsfcGzJkVOBS-2Bi77lmHW-2BqyMM4w6s-2FBmRYFZJwc-2FQSdBAtKYDuQNtode72oF-2BMITl51YnqWhGyvO20o-2FgKHYhn9uVuvlSoek2hZYtD-2B-2F98Mu5Xm2Tz0-2FUIItjKvjtsY_25yE1MSaF2t4Ef21OWLU937Q4MctB958zt48B7-2Fz705AW6RPC1OO-2FOtHRBOPrp0ftlhcq-2BLLFeNMaPZXnmJezAwWAADYQPilh7PUkufv4oX2kmmZMGJZwP0NkmL3tftxzrvioCtYHhFT5OcI-2B5qPyVtyW8fDgQSZO9erPYFlO0AHul9Xpt-2FWygFIiS53ZNxpeJ5UNjr9umOoL6SJIQm9UyWN4XZEiSLudEkLt5B4UgsRiyvqO4REK4RvVC8zu7xv
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4043854204" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1B2D1329-873B-11ED-B696-CA2A13AD51D0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4024322915" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31005511" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31005511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31005511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "379057321" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4024322915" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b712816c6283d4485847da4b6120b4d00000000020000000000106600000001000020000000d0cc1a5fda6e97bc9f3958279c4a297902c193355b2c85d40aaaffe1459b8778000000000e80000000020000200000003e03b845c26a0cda74c582e3a39b2194051dd907dddca426979a28ee63ecbc012000000034b27a3e8ee3e4360f21b57a43c85a673ff6a1657058bd1ef1ff211b462300bd40000000dd0b157022071e15f967ad02bdddb954a90fb6a75e733abbf6153f4018ba846c91b54073b52bbe64b1e343f1ab78a08be624bc94696a66fac73dfab420a74a94 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0daa203481bd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707cb303481bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008b712816c6283d4485847da4b6120b4d0000000002000000000010660000000100002000000018542fea4850d8bdc4c7e78f8f223b0e7a791b4bb7c92662212ca95f25b9b0a7000000000e800000000200002000000030e4914acae92d863d4bee3bbc85572392164b0f24cc09b3fb8d6a240bd17403200000002f11933311b1b90616db8758d5e6c5352da814640276b3c735ea9828d0739cd540000000551a9b274360d104ae06a7c2d20025e7633f42b312bbce1462f7b6329777e24ef66a56bae31c07fe1258f11f30055731979b819b0fc1861fbd2bec070d280144 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3464 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3464 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3464 iexplore.exe 3464 iexplore.exe 4204 IEXPLORE.EXE 4204 IEXPLORE.EXE 4204 IEXPLORE.EXE 4204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3464 wrote to memory of 4204 3464 iexplore.exe 80 PID 3464 wrote to memory of 4204 3464 iexplore.exe 80 PID 3464 wrote to memory of 4204 3464 iexplore.exe 80
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://links.twiliocdn.com/ls/click?upn=3kZIcBV84MSbPEonqfrF6dGb3PJ6jbldw7J3yS57HqemXns2WYta3RoHKq8W8aC7dpcuZO6hV88bATZHBHyDHuPY8Ti9l76WpI7y7y0-2B0tfTn8Gz7zrrkV-2FqxZGEI1pUggRA5KvZyNDlgUTGzsSR5rFfvu49i4FzNZBEDTmqSXLz-2BjS-2Bjf-2BB5X3MM28mG5mqN33bPAsfcGzJkVOBS-2Bi77lmHW-2BqyMM4w6s-2FBmRYFZJwc-2FQSdBAtKYDuQNtode72oF-2BMITl51YnqWhGyvO20o-2FgKHYhn9uVuvlSoek2hZYtD-2B-2F98Mu5Xm2Tz0-2FUIItjKvjtsY_25yE1MSaF2t4Ef21OWLU937Q4MctB958zt48B7-2Fz705AW6RPC1OO-2FOtHRBOPrp0ftlhcq-2BLLFeNMaPZXnmJezAwWAADYQPilh7PUkufv4oX2kmmZMGJZwP0NkmL3tftxzrvioCtYHhFT5OcI-2B5qPyVtyW8fDgQSZO9erPYFlO0AHul9Xpt-2FWygFIiS53ZNxpeJ5UNjr9umOoL6SJIQm9UyWN4XZEiSLudEkLt5B4UgsRiyvqO4REK4RvVC8zu7xv1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3464 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4204
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5f7b6855beb7fde6cdb1a2a9ba9fa6bcd
SHA1fd947696cabb78e309ad669dff0b980b17818567
SHA256f1630debcf83e724c695443316dc8ad1abfb9d422e1450edbd3fc87b23f0649d
SHA512e21c7570af2e3a77ce35f0f4ea4bef6b2a96bb7910a5c84eab60cba45a653b428c92def96f3d9bf393a156ccb901eb9f131eee2b71b91c20c38bf50b9ebe554e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD509922210cebf270bcd296cf5c46e8cd0
SHA1f0a52edb80137e740756c0e1abfb9216cd0553c8
SHA25668022ca2ffd039fce3ee06271d5cc9e5f1c541ed770b31f9a19c92a6b2d91882
SHA512481d72eea93369cfc134f09d73639bbe02bbe3befbef00e3dbe1726db6dd421605bb22fe22d08b5e1237c06dca3e57c7ab0a549b1cc2b3eee904c2267b4b05e9
-
Filesize
1KB
MD5cad17a0d7b491a83b52b9524339a0817
SHA176a4f523b1789a50778ddb3e7a71446688a56e94
SHA2567e44a1526af5fed456d46f13a5ab996aa6caa0c77983d06df76e9ff2b3741c85
SHA512f565a7f773b80626e82cfbca5a1bc58980d383fe2950b38be5e476966f194fc267ecc2b236666b027488151831cbb31dd77b295521a2b98caf1261cdb3bfa627