Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2023, 11:58

General

  • Target

    http://www.ascglobal.com/

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ascglobal.com/
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3988 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4252
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.0.1777853237\2076247707" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef9ffa03-66e7-47f4-9498-c34902e6dcf1} 544 "\\.\pipe\gecko-crash-server-pipe.544" 1932 21ad3de9358 gpu
        3⤵
          PID:5020
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.1.72770639\1468232113" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3537fa0a-8fda-48a2-9c5f-8b1f7595e21e} 544 "\\.\pipe\gecko-crash-server-pipe.544" 2316 21ac6e6fe58 socket
          3⤵
            PID:4896
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.2.1012030774\1969960510" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 2976 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af799e80-f0f4-44f0-9642-66c96ce1f101} 544 "\\.\pipe\gecko-crash-server-pipe.544" 3120 21ad3d7af58 tab
            3⤵
              PID:2272
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.3.654885694\264851713" -childID 2 -isForBrowser -prefsHandle 2360 -prefMapHandle 1456 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5afe493-22b8-405f-9ba2-0de4b482ba94} 544 "\\.\pipe\gecko-crash-server-pipe.544" 1252 21ac6e71658 tab
              3⤵
                PID:1688
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.4.1220787828\1207184986" -childID 3 -isForBrowser -prefsHandle 4032 -prefMapHandle 4028 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf3ae6a8-4e9a-4052-bd0f-373844ffcfdb} 544 "\\.\pipe\gecko-crash-server-pipe.544" 4044 21ac6e6d958 tab
                3⤵
                  PID:1600
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.5.990440796\837959903" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5bcff7b-10f1-4f62-bb20-178a24296ed6} 544 "\\.\pipe\gecko-crash-server-pipe.544" 4952 21ad9ed2f58 tab
                  3⤵
                    PID:2380
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.7.1031912707\695703312" -childID 6 -isForBrowser -prefsHandle 5260 -prefMapHandle 5264 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6566da0-9385-4657-b933-1137cc63dc14} 544 "\\.\pipe\gecko-crash-server-pipe.544" 5252 21ada254f58 tab
                    3⤵
                      PID:4780
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.6.234068642\2031827680" -childID 5 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8166bfe0-92f6-45cd-94db-921fff8a131e} 544 "\\.\pipe\gecko-crash-server-pipe.544" 5076 21ada253458 tab
                      3⤵
                        PID:4776
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.8.696864069\287413535" -childID 7 -isForBrowser -prefsHandle 5644 -prefMapHandle 5636 -prefsLen 26832 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2511f2a6-7bc6-42bc-98db-fed0734ae0ef} 544 "\\.\pipe\gecko-crash-server-pipe.544" 5656 21ac6e5c758 tab
                        3⤵
                          PID:5180
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="544.9.1582917553\1499916486" -childID 8 -isForBrowser -prefsHandle 4456 -prefMapHandle 2772 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1448 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f14789ff-f978-4d93-a865-9645c946cd7f} 544 "\\.\pipe\gecko-crash-server-pipe.544" 4212 21adbc50258 tab
                          3⤵
                            PID:5164

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\299A946F8A19A69D42846BDEBDB471AC

                        Filesize

                        471B

                        MD5

                        0c19d892227fedd904f8cdc90f9f4d3a

                        SHA1

                        7a118be58c85d37fae0910e6b2210187bb4587ce

                        SHA256

                        ab15b5ee436452f6a9f84c5f24f2edbe82e6f8a076e148506817f7ca3fc12d16

                        SHA512

                        a7e9dac089c34349033853fe6d721d9db6b1cdb0ee80f005b37609c73795cf9d5813c9680313b521a5083e4dc68d8132114b5b169cbc5c13339ec2e2a1110aa9

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                        Filesize

                        302B

                        MD5

                        6d3907347f33499382b458ad190971a3

                        SHA1

                        9c652bd7b7b0a8cae763ff31badba08e5851acbc

                        SHA256

                        c9ec1424704c348d452e276a17c655b6326b4f842829fa94d07347f2115b434a

                        SHA512

                        3af35df15e9bf4ebd926263717ac860da0920fc3509c55ebfeefab2591134187d725075fc747f43d3b6cf937707491732652a4e941f95a915113565105babc95

                      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat

                        Filesize

                        2KB

                        MD5

                        7e9fca2046662abc19e14fcaec27315d

                        SHA1

                        335bf07129a4830d4cbf05ddde19d956a668ae35

                        SHA256

                        b07fe0a8eb523f18486575e69e37e4badb75efb0b33e32327de1473d057afb66

                        SHA512

                        1e7cd3544da8399abd157ad52c993c5b8cbd3b65195556dcb5088be73c04fdc11d59526e12da1bc6555796549db545797f87e2c66411f3a4256e2ccff8cad3d7

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\c28421_c9ee113b4223421192ab3fb378b685ad~mv2[1].png

                        Filesize

                        1KB

                        MD5

                        a3725a031b5099e69b0c7da64398b8e9

                        SHA1

                        07f71cd707283b488b8a238f0964a1acdb49dc31

                        SHA256

                        ea38436a948919c11c76228765bf60521ca4a94772ea60f262a033a40e3e1207

                        SHA512

                        2d8675df8a6360da974f1ae04a03351f897971ab3dc81d415310f47db1d0212c02555e935730f0d2c12623a57cdd248b28bda5c9de4bcd8e9322de3d07575744

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\analytics[1].js

                        Filesize

                        49KB

                        MD5

                        54e51056211dda674100cc5b323a58ad

                        SHA1

                        26dc5034cb6c7f3bbe061edd37c7fc6006cb835b

                        SHA256

                        5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

                        SHA512

                        e305d190287c28ca0cc2e45b909a304194175bb08351ad3f22825b1d632b1a217fb4b90dfd395637932307a8e0cc01da2f47831fa4eda91a18e49efe6685b74b

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\suggestions[1].en-US

                        Filesize

                        17KB

                        MD5

                        5a34cb996293fde2cb7a4ac89587393a

                        SHA1

                        3c96c993500690d1a77873cd62bc639b3a10653f

                        SHA256

                        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                        SHA512

                        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\main.min[1].css

                        Filesize

                        125KB

                        MD5

                        0884d87a3203faa9bce3144e6cd235df

                        SHA1

                        4db0d49e9c36272e861774d99a297f7e13300903

                        SHA256

                        4a53e21b476386c3f40b7df620f529493fc3279df35f99c96a063c68e28e0094

                        SHA512

                        96bd1accf724e77c9f5368d0d4f7822ee224f46409a8211c16fa4288d8165a751c77ba40ab80fc999dcf45c7e8ca6def7ad7439d8a672471e0811c3a40612998

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3o4pebi0.default-release\cache2\doomed\19600

                        Filesize

                        19KB

                        MD5

                        1985c2dd86114165e50b06d1de5edd66

                        SHA1

                        f21d7e17b63dec05a7bfb3984c93e44b16151065

                        SHA256

                        85cdac9a59e28b03618acbc9afe742957a69a170cf0a7c4fe7fc1d61f3b05d1d

                        SHA512

                        17f9136048f5c707c5317530d9ddfbf4db0c7d14b8bfa216fb1b93b44ae757f118716d2f76607fa6a061fa14d79e6207f296cc47c5a0594eaa8e5461b91ea5a7

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        442KB

                        MD5

                        85430baed3398695717b0263807cf97c

                        SHA1

                        fffbee923cea216f50fce5d54219a188a5100f41

                        SHA256

                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                        SHA512

                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll

                        Filesize

                        997KB

                        MD5

                        fe3355639648c417e8307c6d051e3e37

                        SHA1

                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                        SHA256

                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                        SHA512

                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        3d33cdc0b3d281e67dd52e14435dd04f

                        SHA1

                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                        SHA256

                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                        SHA512

                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        15195ca813cda90345774b92527c9b63

                        SHA1

                        7dff75ac045d16bef837eece4081e7d91e9bb057

                        SHA256

                        64a486c41ae5a29a9554288dec55bfccaa4d2e0bb0bc34a35341acc0a2ab5988

                        SHA512

                        88ed84717adfef55c5cb80dbd44939651f0b9e0bf9d8a5e72547865ac4fdccdb2e2303dc125c59b16a13f3d0a440a3f3e3160e1d4355145194bb312bda3eaa87

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        ca63f06a8f2ab186ad7d568d3f4a989c

                        SHA1

                        40faaf24d74924861c42b48a0b480e9f705dd606

                        SHA256

                        f630ec60eb9b9ccfc57ab9ffd9bbee7a8b59f64f4ec7f2e535cb406773137efe

                        SHA512

                        f39e3d6240363f2f5e57615edc14b8288c4daf55e64edd4fadad39b7d317794fd093e0eeff99d7da7d9763dc747f9d25662e66ab86fbb44953ee528bf8106cff

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

                        Filesize

                        7KB

                        MD5

                        2876224e579db5dbc7f6ad7d45e9aadd

                        SHA1

                        3046548442c7a0d6b39d3f7e83de383ec2a6083b

                        SHA256

                        60bd0728a95fef837937eb18da9cad9dc5459ba7c45e4d2d5cb5b964eea8cc80

                        SHA512

                        531567d70353f0e75b6354dd70a1fe8b06ab33ec7621c8e2fb3ce68ac8261c0551432881a62654eb0a84a2ae9d9ee7d9d18e435ac761712500db85bcde3462af

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

                        Filesize

                        7KB

                        MD5

                        d974bb6693cf274ea17982ef9c772bbd

                        SHA1

                        08ea75a593094115cdf13fdfbf51be4557c4e3eb

                        SHA256

                        f6ec2d2be0a8d69efdc7984c591c6072cf9e37f8a498432f88f23a4123c273cb

                        SHA512

                        83e58b892f7b53e0e38e0c35634d4c0ea73723fad8914f81864c3368206f1881e9637fe606047f577495f17174a8af10c4a4a91d39283e9c31e0044d9e6a3d2f

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs-1.js

                        Filesize

                        7KB

                        MD5

                        b5b33af164519c41f157affb17db7338

                        SHA1

                        b055c32a5f5af22b064ffdb5543b3929168cd8d9

                        SHA256

                        d466f0f3c0bbfa2066312c951c5901c2b586e34e3ff2f2060c455d5b3da6eb98

                        SHA512

                        18a425b9976593f1f2da1a04d8ec784f6e816986afe1be0beedb00462977df764a0820419581a312350248c3bddd7837021921b4f1ec3628e2d5e7050ac4b414

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\prefs.js

                        Filesize

                        6KB

                        MD5

                        1984b45f201f1fd79d2154406648433b

                        SHA1

                        42f082dc6d4d43333688690bf4dfa7c7f8b618ab

                        SHA256

                        000a408519010d12b94281710f9a987f822093a1efb5293bbb50ca2e4a6a9df9

                        SHA512

                        e73a00cc8994d4023168e93ff5f5b6e6b13ffeb740872b64f565787cbb57e49e64eb03e4de1d8068a6f303f0615749fb27cb47bdbc4cef3fef1290bd3a3a17cc

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        1KB

                        MD5

                        93bfb88ec07ca846b99d0f514145a89f

                        SHA1

                        c45f19949a62107b8c60142208c1e6b1e4aa945b

                        SHA256

                        a4c22f927565f11b8c6b738862df0d223f1cbdf982c7e0cc132b83ccd5014901

                        SHA512

                        dafbfae4973a4a7c3a7c194289210ed44c91cd8c2af073b5aff4e38e586185ff157533de1d73fd83bea6506e6c62f4e172d48e0940c344c16b3c059eab31183d

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3o4pebi0.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        1KB

                        MD5

                        9a413560c1f00eadb8066d9c91c07673

                        SHA1

                        0c1962946f1f42cc13cf1002479867234ab661ca

                        SHA256

                        7af7ecd30f8ba66ee5dcaa95777ad6cc4da7566b8d403bdcbceadf4558b00c33

                        SHA512

                        426b298c97887fe190e03d3905a87e9eb8530cab2edc73d4ef5403a7ec156b41c77df30bfb657f79946cb59c9e1ce382652dcee7ecfb0f206ab275a5f0371c04