Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/05/2023, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
SKlauncher 3.0.0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SKlauncher 3.0.0.exe
Resource
win10v2004-20230220-en
General
-
Target
SKlauncher 3.0.0.exe
-
Size
1.2MB
-
MD5
32c7e3347f8e532e675d154eb07f4ccf
-
SHA1
5ca004745e2cdab497a7d6ef29c7efb25dc4046d
-
SHA256
107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b
-
SHA512
c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2
-
SSDEEP
24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D65DF221-E92B-11ED-8FF9-7621D5A708C1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1964 iexplore.exe 1964 iexplore.exe 468 IEXPLORE.EXE 468 IEXPLORE.EXE 468 IEXPLORE.EXE 468 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1964 2020 SKlauncher 3.0.0.exe 28 PID 2020 wrote to memory of 1964 2020 SKlauncher 3.0.0.exe 28 PID 2020 wrote to memory of 1964 2020 SKlauncher 3.0.0.exe 28 PID 2020 wrote to memory of 1964 2020 SKlauncher 3.0.0.exe 28 PID 1964 wrote to memory of 468 1964 iexplore.exe 30 PID 1964 wrote to memory of 468 1964 iexplore.exe 30 PID 1964 wrote to memory of 468 1964 iexplore.exe 30 PID 1964 wrote to memory of 468 1964 iexplore.exe 30 PID 1964 wrote to memory of 468 1964 iexplore.exe 30 PID 1964 wrote to memory of 468 1964 iexplore.exe 30 PID 1964 wrote to memory of 468 1964 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:468
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6997745524776bc11ad35ec73e13f85
SHA14290c6ccb9ee328a722dba0dbf4b711df032871a
SHA256d6ef8781653dd6fcc83f60079a264bcd6158527f1b6e977b09b06e4ada54a67a
SHA512fbb6d08a93d341b4ad0ded97723bebf7081fcc81a42b0f2126bc30dad998c45b3b8a5a013de1af4b1bd8476025d4046a8d6501d6df8598db3a79ee48cbee57a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51daa49ee28f08297181a1a162c39cf16
SHA1a2399d0b04b93c15aa06c7e92a95e65cc2b2632e
SHA256c93aa9b1b0f4210c4c6388e18b6b009e97b13f50d5e7fa34443fcc31214cfdb7
SHA512497e79ef9e0e6c0d72dad3478ab3bb63c315252d0481cddc3ff8a359051ef644f31f5789e7ad5fc6792d90ec8ff1a792537f88dbdcfc3aab45ed8d46516b853e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4b0a928aaa453b78b8b7c6f730a2d79
SHA153e6a690b40ab8c2ee7199e016879a509dd0be44
SHA256eb058afafb6f8979c285c1e2069b5df5ac4e05d4399fa0a3865e8bc565f7c1c6
SHA51242d715a284eb0d06921dc3e15004e653e6fcc1d87011fd7013daac76a7c3d7f9dd7f8bc3d7af81a39e220776a4feec6e98e8fbf583de1ace903ffbdd4a09cac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e3351b9644623a5ab1172f43fec8010
SHA12d448d2b92fc44c6671c999c51a547b0e5874f98
SHA25632d95692c0c585affb8daff8799dcbb61c2e9d8c2d8ae71554bbc94d761ff76b
SHA512530711e125a5588a0118399fb00ebb30719e088e2967fed6c525a0e511ccf92d436afa31f418cd79dbaa3813eed36aa8b6925fe8d32610d5db92b11920308f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c47ab5869f90c9f12ea5bfb5c09d8934
SHA1948b1ee654e4b36ae5cb3c2248ac632f9ddf7d1c
SHA25663c58e969dc588d443d25c59ae0a704de0d06965d33fd03c4539456f72e7dc21
SHA512195a504da912b3fd4de0a44a04264e4be37d72e6ddbb2cc60bc106d40296296199b5a9e61f3099f90dd188aa47f85b9f3ed46a15aff8b18493a2bedb052448d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bb0c05d2573a14f3c7ac4add7dd7f33
SHA166cc1fc38d6bc48bf23426834c57996d8bdff4e8
SHA25620a148dde7e498b641d89c9e996472790893254762c9f585adb055800fdb7d63
SHA5123b35e720b3205ae970fb173389876b098a686f8c09f309a368231dcb54f835d4b3719aab6becbfb07ed9f8a5edf8cb2faaff7b6ca5821d0038cb868226d92779
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9a4ed0c609c5e7f3f724c4c0caec6f8
SHA1d010d86f27fecc3051ffc72d0ef15347a07b592b
SHA256f072935de1a567105290148ee5e8c65c1bb9fd7633ba29279cba4e46c66c6036
SHA5128783c3294800f40bc95b22b55fbe8da6132ec9a4069ea6ba2fe8bdb74394315282ae14509040593f8366dd58559a30f210b8b39b4583a121ff6857249a2e36ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7d180bacbdabb8c9a05ac70f773b2bc
SHA1b36cdf9ba04ecc3c5e44f1708119e0569c0dab3d
SHA25642564d375e7a88be84728a65bf0ea39061411a268a3c805351ab498c46ea4ca7
SHA5127b5770ce20bf700b133442e9b6a8baf2d69f8308239976b7c933b67c0b29d72eb8c608940cbdd5db54ce9b22df1c6ed58b0514fc481053bdcd0db0e4fe7e26a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517848e3e10c5fb484454e09f4cccc0ec
SHA131d787eeb3befcb575479845aac016dbce47b10f
SHA256048389297a4ae760d018537256d6e36a8c69bcddc6f5fc258193d2610b29feef
SHA5122067b0a702d207477f2ad9ec27afa806bc3b3ac79988207d88eb917b7acee5bc7b4aa52af7bb5ab1b02b9db6ca57788fd5caa1aeb9950b49432265968ef19260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f837bc4a0414313c3b280b940f63061
SHA1512c9d43b55a2f23c80296b89bfb69184354c4fb
SHA2569f1f79f940ff6cc57e81afc14d311a0b150e56bfa58cf1d58166e0fc3642a25a
SHA512314843df2ea4ca5c231f7bb98093752cb6b9a076c0c852b4069cb68e27e14e42e4523ea30a16e971085d3f88019713f010632db1fc59229aa6a8289dee5b3c7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5872494b78746cd509368b364a44b3c4d
SHA1c8171d5b8391da61ce6992edf022385331780947
SHA2564dd32dfca2261449432e8cc1a8341e6a62f7ba2edd9bead1ef772596fea3506d
SHA5129bd57d751db67e7b40aacb5d3d16c9b424efb04b98228fd73a23915d5a813b252cb5a4a3270742c729f9fe28561d4e655a5a40a0fb7bb04dd44525a0375b13a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c4589e7a4737e103d38c5b84d8173c7
SHA1be163b68994a791cf5921ef33b757b5b5cd9fa01
SHA25646e73a23312489a758c1c37af6546ae77dc59bdfa38dbd73a35505e187e01077
SHA512c3fb9228914943d0ef7258e5951a6871b1495ce812cd9c23e8afa4f85cf8a63767c412ca9ff2784f12bc2668d2eaf59dd4afe367a1aa85936b05ee81ae2b1d23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5971dc74ea7c7207db7fc06c85e93ea7f
SHA15756a75f55a38118156f2720c5c0dddafd469e6a
SHA2563ad39280e748b9ad194aa7d476f39ba5cb83cfabd0e1e42a5fc0ec621fc77a15
SHA512f560628dc78d7aed60949c9a25c66b22f1e17c24e7a8c7597982124cd3529d1165b655486717178c6693e4f64999732a83bdb1f6b0fe548bf19a7a233d7dcdc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59077f9d396a369ddb8dcf23c86a46f54
SHA15435b3356d6827eee259d216dd5faf6c8c9d01eb
SHA256c436d0400425401553fb3721ec80c2f9cf66498e0cf99cbae93b9d494551b003
SHA512daf942d3b35f26629becee18cd97c2fe08d5b1e23980118803233fffc29e10d56fe2141afac336b85a024ca67963de5ca56282297c78dc4a270b5400300891e3
-
Filesize
7KB
MD5db5893c752bba9e6291ce9d2f930f066
SHA1145c9099ff948549d2a62ad3475b1c8084ee5122
SHA2569a48fb7c0c58835d5f707fc230b3496218df4afb0790f28ab541963959dd5b03
SHA512e3b45891d2c561234e3bf82f3dee1b035f0d627cadd2222c94b293ad1745bfea18747689ec676631ce36dfb02d7a6dc8522b958bdea772b9d2123eda1b988e45
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\favicon-32x32[1].png
Filesize2KB
MD5dfb98b35bec083cddf7e575ccbc12efc
SHA1f77c5e6f37aec582c5977a76691f992e3ebc3a05
SHA256f053cec8f37df661ce13646ff5ecad7050bd50c4afb4f7ad12cd252577207e66
SHA51217d2d675bc677f126fabab826b4fc79a05eece52cf586a97b7d8093dc402d0160f273fbf9d38978f01befc9f85a979208c2355cc0a4c129a2232ffa4554961ef
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27