Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
63s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
10/02/2023, 16:35
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://s.advanis.ca/e/clicked/advanis?id=IAAgVQBYAHtTAyJDAisdNV0GHgswaw1QHUVQDQtWF3RDakATIBdmBFkERBcOVGUWQQ%3D%3D&e=bob.bob%40cra-arc.gc.ca&to=https%3A%2F%2Fs.advanis.ca%2Fpension004_en%3Freference_id%3DZZZEZB23&k=cc4b40b545047095cfd1a96651502b1ee33f1dcb0733c739a93233829f34bc17
Resource
win10-20220812-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://s.advanis.ca/e/clicked/advanis?id=IAAgVQBYAHtTAyJDAisdNV0GHgswaw1QHUVQDQtWF3RDakATIBdmBFkERBcOVGUWQQ%3D%3D&e=bob.bob%40cra-arc.gc.ca&to=https%3A%2F%2Fs.advanis.ca%2Fpension004_en%3Freference_id%3DZZZEZB23&k=cc4b40b545047095cfd1a96651502b1ee33f1dcb0733c739a93233829f34bc17
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64DA8B90-A969-11ED-A7A3-E6969348A192} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings firefox.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4236 firefox.exe Token: SeDebugPrivilege 4236 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 3728 iexplore.exe 4236 firefox.exe 4236 firefox.exe 4236 firefox.exe 4236 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4236 firefox.exe 4236 firefox.exe 4236 firefox.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3728 iexplore.exe 3728 iexplore.exe 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE 3728 iexplore.exe 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE 4236 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3728 wrote to memory of 1596 3728 iexplore.exe 66 PID 3728 wrote to memory of 1596 3728 iexplore.exe 66 PID 3728 wrote to memory of 1596 3728 iexplore.exe 66 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 5084 wrote to memory of 4236 5084 firefox.exe 70 PID 4236 wrote to memory of 5048 4236 firefox.exe 72 PID 4236 wrote to memory of 5048 4236 firefox.exe 72 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 4840 4236 firefox.exe 73 PID 4236 wrote to memory of 3248 4236 firefox.exe 74 PID 4236 wrote to memory of 3248 4236 firefox.exe 74 PID 4236 wrote to memory of 3248 4236 firefox.exe 74 PID 4236 wrote to memory of 3248 4236 firefox.exe 74 PID 4236 wrote to memory of 3248 4236 firefox.exe 74 PID 4236 wrote to memory of 3248 4236 firefox.exe 74 PID 4236 wrote to memory of 3248 4236 firefox.exe 74
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://s.advanis.ca/e/clicked/advanis?id=IAAgVQBYAHtTAyJDAisdNV0GHgswaw1QHUVQDQtWF3RDakATIBdmBFkERBcOVGUWQQ%3D%3D&e=bob.bob%40cra-arc.gc.ca&to=https%3A%2F%2Fs.advanis.ca%2Fpension004_en%3Freference_id%3DZZZEZB23&k=cc4b40b545047095cfd1a96651502b1ee33f1dcb0733c739a93233829f34bc171⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3728 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.0.1398599296\1217957031" -parentBuildID 20200403170909 -prefsHandle 844 -prefMapHandle 1328 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 1608 gpu3⤵PID:5048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.3.215172516\1735146050" -childID 1 -isForBrowser -prefsHandle 2232 -prefMapHandle 2228 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 2244 tab3⤵PID:4840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4236.13.1084875212\1560431933" -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 3528 -prefsLen 6938 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 3544 tab3⤵PID:3248
-
-