Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
332s -
max time network
334s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/04/2023, 13:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.apple.com/ca/ios/app-store/
Resource
win7-20230220-en
General
-
Target
https://www.apple.com/ca/ios/app-store/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387214202" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300201b07765d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000b557b3724711623cd05150f8113d497ad2311bb20a0d41c44abc99550b6240aa000000000e800000000200002000000056bf6de8d0358bc809829730c6c27315029437f6994d8fe3c79578764374a7662000000072f2ee731ebcd76ca0ce2e357af378071fe2de06af92c75a4d30998891d7b7e640000000e6c4423efc6cb239a81e83c75715a9aff1c2436e77cafb4289ccb51568814e813beec481250fc9b99a7d7bed7a9ee981979bc304d1e0b5f597fea444ea7a6765 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4213CC1-D16A-11ED-AB51-5E76FDCFC840} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000aea951634fc4200f5ba83a26fef67b6a16add1568357e9f842adfcc9f22d83c2000000000e80000000020000200000004b31439aea9d0534c2c6c897c56485ceef28e16c41228146c9666dd0e8eada8790000000e4463f91c9970adf4583f726664adc469589134f65d98e66e74813610d18549049db4596739d16483a343c403d9c187e56f3fa89dd63aa07ade04933050e6f339c97228d05222cc5fbdaeeea1985ee151c45cc25dadf9d999543d1a3d5eaacedd618867ec7a14b0c88a553b59cec12cbd684f32cc38771a8af654c33f2b42011dcd0c3ceacda85148b13c729efff7434400000003d810ba0d045302902eb168de3136cf43a37b58c109e4c17553637db4a28d8cc6c71231b7513cda0fb5f366f1c7f4db9a06f43fa0cff847535bfd57c908a4515 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1720 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1720 iexplore.exe 1720 iexplore.exe 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 672 1720 iexplore.exe 29 PID 1720 wrote to memory of 672 1720 iexplore.exe 29 PID 1720 wrote to memory of 672 1720 iexplore.exe 29 PID 1720 wrote to memory of 672 1720 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.apple.com/ca/ios/app-store/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:672
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52b5294acb938e458eb648ff5a09ef674
SHA1149dcf1f1afc03213918b50cf78f42eff8a16cc9
SHA256a0f1f72db1fe7ef711a9aec9b5d96536bc333bc81dad0cbaf892df28f195d800
SHA512ff7ee44d06886741e1bd25de94a275005b58f66d2156c23e81d8ef31124f92414cb47a5abe5b2053e41e9c20dd1d06a1ad26354432f56df76fd7d5eefaf51d18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52f7972a3aec46992cc3c25d8f1d14b6a
SHA1550ce354303c958d870fdaa20e9ea70beed8564a
SHA256192b24d18aa1896510e6ecbc8d32102251b35a2e17ec3e93df29ef224f00ae30
SHA512e9263700010ca7e92722eb3dc91d24d5bc7262157ce9d4714a518721935f2f4e6c15d1be7e73be0fead84b98f3434ae011c07469758cf3b714df810f20f99c5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e0df0bcebffe43154223466be3c72745
SHA1af0d771dca102c4174d5b35b62339aedc1cc0474
SHA2564165865f9ba09f6054b52660c7fb9ed370efa07534ad01ee745b022d5b1274a8
SHA512d9eb338486fa218562cada2e31a6a00352a0719f4cb828e33987538b35da5efc844ce25699f687720f547bb6d6c701ab7f7c0f3e1f58ec0baf9e2816ef9b058a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ede27e4b20178142c09fcd4a8e99d7f5
SHA1495955360da0f8f727bb3ef6c004da63daa1412c
SHA256316ccd78e0fc3de01d74cc55fe4b6bcff675789fb2dc4f21baf896bcceae3465
SHA51262fa692472548cf009a35cb5d527a4cb704a7105d9f19b47d04aed411b3966a278f894a20838f6ac84d529746b6697628e9e8ead1a8551fa93907c27f7f8f3f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53aceee521f5840672cd8d3d21d277a33
SHA161c4e8fd0058e5f1889e9f75a3b96ee693b6d491
SHA2561b0cca142da0fc72478a2df5a24f48365912723ceb3bd15c5158ce72a1118a26
SHA5124e4bd262c2cbceed4ac97d1c53a6af29c69f1e40bf668199e72260dc51b439c3ac488b19e31fa4d606cb4e69480d0dd6f6d2eaf740410a156e168adb58c2d8f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5433f1b3e96296ae508d2e26ac315af5c
SHA1317a4bdc6f1a569de2439fe989fb068f3be25120
SHA2563cfc0faaee96d4fc4779d8a4f7f1daf4ced185297e228dace3ce789e759e35e7
SHA512d138e7a96e3710dfb3569998fcbf672b62adbb4167665955a247ec1d8166fca461bfed4f866d26ed1520d5d504bc31fe18f5802c1ee56b6cddee584a86f631f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD582779d826551ba9a5e996d55d849539b
SHA1dee471f4ee7eba0b9f31d939a627b4df87d70001
SHA256887c35b9604ee360444a678603d987e09e0c2e3afefdb5c8853a669c4c738a12
SHA512fe20f9cfd014036c47446d868de959d7c7121e4e11333f2919abae37d821823fd22721ce61ab58ce6b58dc675c2654d47b79c9507ba5eaef2c05e37196e98382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d876982e58feda388ada56a9c60b661e
SHA1920bb93a3a99a78bdf2028a523277b5953999973
SHA2566445779f46d229a53fbd10bb39f14962ee16d754c08138d46899bb964cb2dd94
SHA5128b54a223cd456b663c16b41d5f8da5f16393db5dbdd26d86a91872cfc5cd44fe1a83807828c066c4cf74cf80d4432ff53d8725766eda9b47ba16d519d737e790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57693eb536323e1863f52ed0034f7e421
SHA1fbeea1f201ee98191d3abd0ca12bda513da5979b
SHA256786517e8105b059f462004bb70f1effffa2c710814be797438f12db8915bf837
SHA5122ed4a3d757324cd465b26fc8f0c90cf008c47757ea8c76f90f03fcde19e92f5b42f0bb0aac677e9439a80d07fc3630ee9c5860c0ed401124b489b2c8f1c35aa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5391ae48008e78303d6d097c8172cf01a
SHA167e316d300dce85eb0ea53de0e960326ffc7c64c
SHA256181d402f619685a57270f50855011f2ae7e5731a9a8b789c1dc871278ebc7a9f
SHA512e017e5a3feb0cea25c142149b0cfb718dc9d66caa25aeb64356aa46d5908feda249642bb0fb8379729628f487491bf0f46136ef3c71f499a452b55c2c215db8d
-
Filesize
26KB
MD53291a6cb12f5d8600c1e891586ac0dfe
SHA197902df735cf7ed25b9b3e34565f8e973969b641
SHA256988234b4a45dfdb5095ae78595749b36605b2aab7c9afff3cb8ff88679549a6a
SHA5123f8034e5f2f36fd2bca5e909f644e873753042bbecc5b44a288f5f8caa326ce6d7c69dcd05f0e3482fe8b37aca8e06ee73b959030c41a8f1101bd5fb407666a8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIMPJA9E\appleicons_text[1].woff
Filesize1KB
MD5dbfb39700c2ae4be64e11f56f67b8800
SHA1594a44bafbe3c796dcd000c8a8a6ebbdea553f6b
SHA256b36e10199ae62e788fab5e154b2694409745e146f026219436b71d5bca185c69
SHA512b22ae2a3127c972cd9249af89759c14b8d36e76a41b1d556be896e51f8c16deb22cc612ab02f92c200842269cbb2ee90f78ebdfe683a67adcf793c5bd7ca4a74
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\favicon[2].ico
Filesize21KB
MD5891e510219786f543ca998282ed99f45
SHA119fe2ff6a2418bcb44b02308b998cef84199ee08
SHA256e4bdf72e2f803f7e19907c12f407ac7f7cd5f1f94bfd730b9be24b0d49191b48
SHA512e6729e7e1ed1909297317e249adb7af6c230b2a7082ea792c7776fa5037c8ed8aaf02bcc4015334b6c439732f965ce19291ffe863126d0c20bed9a0c89c4a95b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NMXH1C0L\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
600B
MD505bd5632cd0c50d286292b721783f511
SHA1a2d832f4c936d3fb4ae8fe7db52678eb95d699fe
SHA256524a0625c7fab3946fdc74cf7f4572649bf42197eada9ac4d16aec765407ed7d
SHA5127f228a34c62962b1be2ae47013b8c6cd0bb7c19188c7881eca44a980a9867e78dabf2bd8ebef223db7cd038d9bcfca5ff0f79f506dbed2d7b966c934e8639aad