Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/01/2023, 14:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t.paypal.com/ts?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&calc=a33a9d877b68d&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=op&mchn=em&s=ci&mail=sys&appVersion=1.141.0&xt=104038%2C124817
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://t.paypal.com/ts?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&calc=a33a9d877b68d&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=op&mchn=em&s=ci&mail=sys&appVersion=1.141.0&xt=104038%2C124817
Resource
win10v2004-20220812-en
General
-
Target
https://t.paypal.com/ts?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&calc=a33a9d877b68d&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=op&mchn=em&s=ci&mail=sys&appVersion=1.141.0&xt=104038%2C124817
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381858718" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1937898902" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9E16CFAC-A0B5-11ED-B696-72E5C3FA065D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed3c123c0e4e6e42b50b2573bfc44f190000000002000000000010660000000100002000000044b4a278fc93707de2df680b5cde0028d585120aeeaecf0d316e75c1d2a6dc00000000000e8000000002000020000000e7bec5033abb78b321967ee2dda921b74c4b17e5c798ee76561cf3dc3a4e6a9b20000000bb78073a7c5ea287cdaac986e9aecdc621b5c01b81b1bc617fadef8f20ba303240000000083f2d8fabd2418e07cd399c99385e1a5759a88055c6a3a203ba4951c88679b91a08ad6efec845ec53b146efdbf237a57fb88077eadec0760fa4c288adeacd1e iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1941961693" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31012034" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1941961693" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31012034" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d03375c234d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1937898902" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31012034" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed3c123c0e4e6e42b50b2573bfc44f1900000000020000000000106600000001000020000000e765433bf41b9b8be56fcc0f9b6e2dfd7f334276c431eee6f3c1c188ba5af6be000000000e800000000200002000000008255556b13b3a9a7383961ddebc6e23ee5b75928e1904826d1a32eb052d2c74200000003afa03d35a582168d24b4799594d9d979d065a86741bb1a6875895680a375f64400000008086f012b3f94b7bdcd41007907439b4be2219f073ba75eabc8f111430e31a03833e398ab38bd197ff045625f0fd4a47a8704f8ca0558343382ae9016f48f738 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e34675c234d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31012034" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 748 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 748 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 748 iexplore.exe 748 iexplore.exe 3080 IEXPLORE.EXE 3080 IEXPLORE.EXE 3080 IEXPLORE.EXE 3080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 748 wrote to memory of 3080 748 iexplore.exe 81 PID 748 wrote to memory of 3080 748 iexplore.exe 81 PID 748 wrote to memory of 3080 748 iexplore.exe 81
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://t.paypal.com/ts?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&cust=&unptid=f233c146-9f16-11ed-83d1-3cecef6afbb5&calc=a33a9d877b68d&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=op&mchn=em&s=ci&mail=sys&appVersion=1.141.0&xt=104038%2C1248171⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3080
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5ee0a37a05b705a5f66ebdd61da30b479
SHA1136f52350f4f9213cd7a3062b4143b64a54c9549
SHA25611a400393192414706b8051b4b37f3ef76d81885d41e0259d17a1517c2ccf56f
SHA512c724734022d241f608b8b9515a6c1c87b4899f2d2dc2ea637a6c2acfabf7f00864bcf4478359f9ac5de31316046151e25eca389b8a9d136d4d84fcd61f9670bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5fbf9b38315ef0dd2ab28079c24838be0
SHA1d5a3f81ec7ae6c6fdb534613a38582d438d16658
SHA25691b5272f62bb4b4534ed1394de1a4575d1b5bb048b7f630214c4bd8b9fd720e4
SHA5123f98c2fdb88ebf12da5a03acca707f4ba136adba6f32c931d966a517d466e7c1b0444fbe180c14235ebba4cc6618d58d95fe9e9926642d445b5836a4eebdedcc