Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2023, 03:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://workink.co/4I6/arcanv2
Resource
win10v2004-20230621-en
General
-
Target
https://workink.co/4I6/arcanv2
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31042707" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "11795399" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042707" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31042707" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "18046980" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2BFA7C9D-1886-11EE-8DA0-EE95AF563B05} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "11795399" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3564 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3564 iexplore.exe 3564 iexplore.exe 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE 1496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3564 wrote to memory of 1496 3564 iexplore.exe 87 PID 3564 wrote to memory of 1496 3564 iexplore.exe 87 PID 3564 wrote to memory of 1496 3564 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://workink.co/4I6/arcanv21⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3564 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1496
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD542b28ee2017bd7c4d7a394ddfd2d2bd9
SHA1c7818f9f00bd728729fd0b6214469e0682103d18
SHA256b25e5ebac7e3a33c0d22fca2bf341f619823c15e630d57794fa92ffc9aecaa86
SHA51236b38aeba5406d73b550fb9e0d6860969dfeba29016bb0f76323c503dbd7fea5208ec679f39a27e7c3dc71268c45624b64ff698055a95dde0a5a64838ca0e70b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD52a0e81c9ecc3309cdcfd97b0eab78dea
SHA16d0966d7cc1bdea095050fc68087b46657bc58a5
SHA256e38903a03733fafa95800a66ab33f530a425ab248f30da99356f82ba4b3fd2be
SHA51272b2d87978c9cd3b8becbb14e40a23866db1aa8f55c91e357e9f28efcbac8e5340b2a5649de910e91e49b7b752ed575e4e8e4863a7d220ce8f9080052004f777
-
Filesize
66KB
MD574dad3712be91c40cc7a480dbb4742ab
SHA18e68e526c93767c7320f4c1dc15c09d46cceb633
SHA2564e2d900ae3140f8f1e0d15d6662472d37255077c9b262d874506fea7fca3f292
SHA512327a3aa9314d1e09914318e5b70d5454013ae6c79d92837c18095ff7be269b71663ac3e6e83a7bfadbc2f5d025e889ca7c0a582afd106e0813fa7874d8e59dcb
-
Filesize
66KB
MD5afa017d3bae1d7539d939babd2d8fd67
SHA116ecbf50426dba05f7020acd46029894d4148737
SHA25668cca3dd30e521ceec8d25007ef10349c4483343dcb8de14c3ea533ea8b53948
SHA5126697ae0eeb7bf0c2cbc85b3e38312d2715cac6a4ebe8b294de10fedf305f10693c1036e1189f2327c8010fdee5a098f2cac39a0ccb1ee021b03cf74e46b18b36