Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/04/2023, 08:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cert.pl/
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
https://cert.pl/
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
https://cert.pl/
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
https://cert.pl/
Resource
android-x64-20220823-en
Behavioral task
behavioral5
Sample
https://cert.pl/
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral6
Sample
https://cert.pl/
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral7
Sample
https://cert.pl/
Resource
macos-20220504-en
General
-
Target
https://cert.pl/
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84329FF1-DE9F-11ED-9CA3-DEF2FB1055A6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c3ca61ac72d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f35fd4ec1ca1494aa57fdd0dc6b810a40000000002000000000010660000000100002000000051fc43254912fc8e04fca0dc84efc31a6697b3c19704ba6e54ec173b9b3482f0000000000e8000000002000020000000b92258f3f25ecc7a02e59ed7f9b41b546bc52741b58dd2575b8dca5db8fcb8ca9000000062c6550621d23ccf10859b01fc5006ac6080717f6e1eecc7c650849ccf0ca83a32045b9e489c2266c8c1c5e9750fdfdea478faf86d99ac8a793b49651dd003a2cdadacaa811b9dfef60d73493082d76cde4ca9b7d996f2495b6c9eac6801537b6f104a4e36f4f26d7dcd52681cc41497d00495d557a6ac317e7f997b1943aa801d5d2433cd346965df092f313c53512340000000c96e2f83a973b63a4709a2032e6398736c6e239d25adf065d690c52562758cde66c570220768154ae6fbb7b168386e9794592af6ba8c57c092e162af91f535a4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388666197" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f35fd4ec1ca1494aa57fdd0dc6b810a4000000000200000000001066000000010000200000002305f1bbd5d85340dd1da5b11b3fbadca1503d38b01ebe16c73e0aee73b6fd0d000000000e8000000002000020000000b68e4db627283f4089d092596d03a172e3f409823a0e91c963fcbf62b0241843200000001bf218265dd40ef410c6e3b94d6368f4f760bf732d76375a9bea738bb39eb5ca40000000afabac4d8b04340af89e0ca296b315415f1785776b749ce7bdffb9d77dc188cda647f3d0d183b90c6cc95fef1321e2e09b77fe7b9336d83ce40f995e43178758 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1636 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1636 iexplore.exe 1636 iexplore.exe 328 IEXPLORE.EXE 328 IEXPLORE.EXE 328 IEXPLORE.EXE 328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1636 wrote to memory of 328 1636 iexplore.exe 27 PID 1636 wrote to memory of 328 1636 iexplore.exe 27 PID 1636 wrote to memory of 328 1636 iexplore.exe 27 PID 1636 wrote to memory of 328 1636 iexplore.exe 27
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://cert.pl/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:328
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5109258de8e264ccdda8a327237a774e6
SHA117865232f29153bc6c6145caf67e8dc288393d65
SHA256dc8d3d727e83ccc9c13dbf9d20a49fea6686282475e46e78091e7b481b24b0a1
SHA512f65663e7ececebfcc55b0854e203522a445d4ffeb320abbaf8742d496bfcb91f5b356224232240b2c2d99446c7c7525ffdbdfbe0113710c01b815801284cb504
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55f980b859a8c043c55ae776f42fe8a0a
SHA15b2d9605d89bea0c842f9e634c3ededd7e979c41
SHA256e667ef44c72528f5eaa9841c3b5ab0b6193d6eb3a9cf24db4ad0189d090c85b4
SHA512826afd0cda58f72d28608f4a11ff83486d5082d9a2fd255c4dc817b46dc03fd056965f2878960ac3d8bc002778af5d9a954899f0b1275f8007e616de2521b37f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c429445d9b15b36b84fab98b1994cefc
SHA1bb813ac963a8aa1f8f20bacf36df07d58e025251
SHA2563f2b7ec53f75ff388f661a3a2764d508ecb9827d7ea14c16e1db423df328c6a0
SHA51203a4545b22ecc2968e0ab0514777258b682d061a2ddbb17ce44b7d3c9fd3c4ebec742a9db5b57c962bfa2b9a7a6ad9eb7e4889f5c92a9f098e2856724b82c334
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a72af7ae592e3926f1b8ec4557d5a1d2
SHA14b2da96f7601fe0b199d0a5724f1ab25df8d3405
SHA2561fca5a41f65484a78d27f654c1cbfb06bd9cbde424fe13c02c050d5640327593
SHA512cd5099fc1a3bdf3fc5bf4e7a3840f80566e2016f7a111ec6e772a05d1cb3865a5b2c1fe95a4d6a6a3ed95fc33807b3548a21cdc63d247a3e74eb2602daf785f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e63377c62f525fecf244e1fda733d6e2
SHA1a5d4b611b7717461a0b0d6099967a1dbf6dfa89e
SHA2564b2545f102d26cd8f1a7dd0ecb85ac940d1db2f0a885d3849bcfc032ce62fcb8
SHA5127a9c3c0da866ac9c87edaa44175529f563b42cbf9da769bb491d1fe6a970c5e3c2d33ea8e1798ad77876dd52edd7d4d61e2d9362847916ae6c7c3ddb44e53d1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d2e8a0bb47f3a81f85d66cd27b60f64b
SHA1e299297408a294c6434202814d42af9be915eca0
SHA25634b352481c91571daf8b0595d8bb3948c7e9d66cd81956257435db1dda1d6149
SHA512abc8abf2204d3543d718fd30267dc8d9250f01296a8b02c4044c4ae8ac5d2f7b67ac15dd9107a3e410f73c30d5bb95970f562da496f007deb8c6dec2a4e615c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5670ccf0dcab11291d67617372f70dc63
SHA1d04c833e00632d0293cd2929de7d408211452732
SHA256148168f29a1b7b08747df72a6d043bc37dba7d78cc62fb9e863f0604bbca9dd7
SHA512e6a77aafc9389b93a8449560c6582ee0e905b0bc50bf994195515d034e84a6cce2f4cc44d17975b770470250de9b80e3e83ebcecee903f64d3da24d7563349a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d0b90df319ad1ccfad8da87d2cdac682
SHA1781a57ec171a8572fc51f5547d0dd8b6211bfe46
SHA256f8ef30615baf883ec0a476071f3fb206f6a5fb7b1568b65004a562be5e2f6a8d
SHA512c362b871e02bcdd99d10ab45acb95c2d5f7f9d9b43772ce51f5c8817105af8897a75ef3abe37294f7eed5548d36209365b55196bbc40f3c659ecc3ed0d477502
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD544a102970f8ae38abd91569a044e3c76
SHA1f790250e986cc0dac567abc736a8569dc507dddc
SHA25669da9bc210e34c912d4f7d9b793ce31ae4e1551ba0490297724eae4bcb4afa35
SHA512fff84b5d32388a3ad9e355ba7318d2787c4d174c36ac3e35eea9d27aa125e9338838a1b8809a75b2b274b427bb77a57cdf45b1f3ef242922d48234385d5755d9
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
5KB
MD5a399e8450457248ce883de91d6ea6f6d
SHA1c5b8b917eb49dbd3830f94f75642159f42e0d67f
SHA256308832481d4d750fccf67f1dd92b1f9c3e5978ff0b711470b701982ea4e8117a
SHA512d7ed5337baf6043eb9c610161f4cef94d37e6b8586ef5e8799cc8f70a475949b4b92d2ae633ba848cf4cfea71165c8eccbcf345de82d118937d72b2c65c6de88
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYTOKVEV\favicon[2].ico
Filesize1KB
MD537013ee35e340a9f0bdf65ec56b21f18
SHA1c224c200a0b58d2d4f72be89af6224c8ebcd17e0
SHA2567f13ba910bbbce087f281fab40452e6662256df441e8c30aeac79c2876f059fe
SHA51273341cf926b6fcbe71a73cf3afb70c214f9a0e2a72ce2f69e66e96a9275445c515519eec8ccfa3fe717066471ff0cdfaa527e650f2bf934bc093933671ba7eb0
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
608B
MD53c4ee3fc21107bba6cc2c8d4ed0f992c
SHA16715d2b1eadf5272793153f8bfcaf25d9094fc46
SHA256b3b4d297be7db12b99cb373369e9376510e5a07c3e708efd88752edb2d2dfe43
SHA512b6de6215fad7034564fbec7e1a7767ae9044856bc4c8773496b91f81797f7e2f7d027fef98591d6dac5c7a76e19e049ed08cbc40ea67af07458622db27c7fc96