Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2023, 11:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://s.free.fr/Q8RfeHh
Resource
win10v2004-20230621-en
General
-
Target
https://s.free.fr/Q8RfeHh
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "17" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20505b267eaad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31042174" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "729" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042174" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "729" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "765" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "965" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "330" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "719" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "574" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "942" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "719" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "550" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "679" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042174" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "941" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "679" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "942" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "551" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "742" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{536B5BFD-1671-11EE-94FE-7295A88F71B6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "910" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "1110" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = 44b31a247eaad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "498" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "941" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\IESettingSync iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "574" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "498" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "742" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "741" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.free.fr\ = "741" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "550" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "728429477" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\DOMStorage\free.fr IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "330" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\free.fr\Total = "765" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3580 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3580 iexplore.exe 3580 iexplore.exe 3712 IEXPLORE.EXE 3712 IEXPLORE.EXE 3712 IEXPLORE.EXE 3712 IEXPLORE.EXE 3580 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3580 wrote to memory of 3712 3580 iexplore.exe 86 PID 3580 wrote to memory of 3712 3580 iexplore.exe 86 PID 3580 wrote to memory of 3712 3580 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://s.free.fr/Q8RfeHh1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3580 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3712
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
994B
MD5c53bdcdcdb70b5d247be3ad8353a0d54
SHA1c39da3560bfdd488af5fd4621c6183c14d726455
SHA256c9cfca3d3b6d690d55ec54c152a85385f365559dcb5f043674e2649823cf1bc1
SHA512b42255667c8bfad9bcdd23d2e2cf6f466b56056aed45f018339cebf0130c62c493b7ae072185039d7fcc684763b81fdf523b9978918ca394dbc711f02ce71381
-
Filesize
1KB
MD5e7d2d05981fbd4504ae5d59fd40b56df
SHA1d4a7f5357179b4eb0c8cf1706c611f748a3738df
SHA2560aaa929a3f478b561ea15c4bcccc5bd8df7c3b540bf02a0771b8bd5b26b135ec
SHA512dd79fd3df2e7873f2bc067c27296ad803a1599748a87f8ab3f6e014215057b75f95ccdd713198c789b1df678bc8d99d98d4307456b4deb9327b007244471e590
-
Filesize
1KB
MD5b9d8f8d1df4bca9590327c8b51ab730f
SHA1247e9d6be62c85530249a3b4216ba89c23ef55de
SHA256eb4b60175dfb19e327b6c2991ee376f18190a876a84a267a7f034d3f9f397053
SHA512572be17212d248ee35395d96d4bff4e601f2237923d089e5688b51f3a9fb4093e528b9f1d93e43c07fa05c4c862d37a719204fb1ed1fbe2813f859da1338793a
-
Filesize
1KB
MD5ed97f97977f3479300648bc20751049e
SHA19e9d203649191a20b754947164cfe402002c91d5
SHA256b634caff83256a0c6a461e37ffa8ff794e81a6e5749ed35b5996b5d59e3fc1b9
SHA512915949bb55fda82ca5bc42598de622dc13262454646e7c220232c4ec340c0ac985d97468c8d2877a2354cd6e6ae9c1ed9612524738640b67b6c2ec135b74c001
-
Filesize
1KB
MD5ba07a44937e183d3144ea46cefd3dbcb
SHA18bfc631511db98f2c7bfe17317cfac5e4231a2e6
SHA256ad4c74079ba31b78a1b4fc68a2eb9b4cf97cb7f2f5b526dfdd16b552371820e2
SHA51204d127f406185afb59287658df9208d00e0476289e7f5e2102fc1eee7a9f61842d7ecdc384686214e0de831398a25d3b6a9973087dfbbdeac069cfb12fb8231b
-
Filesize
1KB
MD513411f9226c6a451c03a7632215776cf
SHA19000dc65fc97e5d8819fff5fcd1f81585a260856
SHA2568c3a7acecc61f0be1f3075bb6c869e91b17edc43e510e102d3f949152a607906
SHA512f11654bf539c17581b8a35a2427504c816d7647fc00c870dfcd9e28091bd40abfb847ef25f7401f7492f22fc1545b6cec8627b33b87a83b9ab20d3e457d7afa4
-
Filesize
1KB
MD56d70aff71c5f190796a66eb4b3b51358
SHA1dce0cdcccac383667161383131ce792d68904c8d
SHA256abb88b183dcff4453ff36c8f26a8a114f8df90b886f2de6c96de610da91823f8
SHA512df8c692f995044a31a61fc97ec7bada65b7ffb5101dd4edff33b23f70dc4ddcf0f4637eb7619c8684e0ca031b48c5baf86e549940def1db36b8f4adeb2bafa94
-
Filesize
1KB
MD56d70aff71c5f190796a66eb4b3b51358
SHA1dce0cdcccac383667161383131ce792d68904c8d
SHA256abb88b183dcff4453ff36c8f26a8a114f8df90b886f2de6c96de610da91823f8
SHA512df8c692f995044a31a61fc97ec7bada65b7ffb5101dd4edff33b23f70dc4ddcf0f4637eb7619c8684e0ca031b48c5baf86e549940def1db36b8f4adeb2bafa94
-
Filesize
1KB
MD52f316657a69ed56d822208f572f63d2c
SHA1ed49e5d06fb47b64927e1e2033c7f2569ad7f914
SHA256478457b7b94fa4591cfc249a27c0837ba1b98be142591f931d310e922b953b80
SHA5120f9a48a5ee5311a32806f92273e6e54a9143b18f2a1f443922d560b196874a43d3d882e678ff5c888a07a0541a0f533763d930c76e77a5244e4912a9bf743773
-
Filesize
2KB
MD5ac250fe45cb12344a6083946a4655b48
SHA1e562df3c62107c3f6cc1ac6022eec6e0ab0b2de3
SHA256fdacb7698207e0c4b29ac6f1e0cee4ae906382e13c79df6356221dbc6979bfa6
SHA5120ce8943144952e9c740ac40577639d8522bed2d18964ab901e3115ebb896324fbfb2cdc63d2ca2235aeec1a26e86e794b1e0cd3dc715c48fd26286a3c1ecefb3
-
Filesize
2KB
MD520aa29f1d105096b3cf0521723d07ac6
SHA1dd5183c93883a89f53b5a3e4b1f7ecf7913d7ef3
SHA256f6139a7d0466aff13cc81eac1e6501c1a70794dfa46d0bd7ee568ff3df56a7fd
SHA512937464e66c40fd16a379814d16c1c71e066ed7470b2c476ca822732ac0dc52b0758215a82a997aff0c85c7da6cf05b02dee496967bd5908f11f83e8fc0d1324f
-
Filesize
211KB
MD5001a985267f5db4fee76d84475c896b0
SHA157b6eeca7ab7f2e9f401c814302e2458670688b9
SHA2569687b591cca30016173e7751f3136d7e7550079f57caec5153602de52d4bdd93
SHA51216532e57506622ed9017bb7fa9eae928b039f8da4bf8115bc611369ee15d07e83d57c57b4fd1688d42b5f6dafb485d561e167ed044fd10edfe7ba9d7f266250c