Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
70a036807dc...5a.apk
android-9-x86
100a036807dc...5a.apk
android-10-x64
100a036807dc...5a.apk
android-11-x64
10closebutton.html
windows7-x64
1closebutton.html
windows10-2004-x64
1core_wrapper.js
windows7-x64
1core_wrapper.js
windows10-2004-x64
1lynx_core.js
windows7-x64
1lynx_core.js
windows10-2004-x64
1nd
ubuntu-18.04-amd64
slardar_bridge.js
windows7-x64
1slardar_bridge.js
windows10-2004-x64
1slardar_sdk.js
windows7-x64
1slardar_sdk.js
windows10-2004-x64
1template.js
windows7-x64
1template.js
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
19/07/2023, 20:45 UTC
Static task
static1
Behavioral task
behavioral1
Sample
0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a.apk
Resource
android-x64-20230621-en
Behavioral task
behavioral3
Sample
0a036807dc9b6da62dcbdedd22fd44bbf31d4851449d044672bfe31121aff25a.apk
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral4
Sample
closebutton.html
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
closebutton.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
core_wrapper.js
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
core_wrapper.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
lynx_core.js
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
lynx_core.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
nd
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral11
Sample
slardar_bridge.js
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
slardar_bridge.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
slardar_sdk.js
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
slardar_sdk.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
template.js
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
template.js
Resource
win10v2004-20230703-en
General
-
Target
closebutton.html
-
Size
981B
-
MD5
c8efa039f4f84b2705a8e3a3b31da61c
-
SHA1
669749429feda1599c4ee980cfd67fbb1a54c1a4
-
SHA256
494693c2ac56ecac1a2588c25631e1bf71211fb0f06108649a983c879315b1aa
-
SHA512
db6c9817469c937a41eedbbbdaeb21a0860fa5228258978fe59d29c75ab1497b8d1a0ceaae2b236206d6935e186deaf0d83a73791658fa68a985dfc5c314aed2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0935c0882bad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "396564506" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33B65AD1-2675-11EE-9FC1-5E587CD0922C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000a3c842eb17a087bee9edee4c54b533b7d7e680f98cbce8ddf63aee79024e5c45000000000e8000000002000020000000406daa5e21686d50c28192f26dcdd71fd54edede8b86ba57869728c996ae50a6200000007eb30d6ca34df6f639bcdcd166b52db5b2f074dee8926e86e78f213d358f95b840000000031e59b6fce3cf5554dab88a6367f7757406dc46f2c2078ebedddacc6d459b872c734f5043b7cb3a04a5b189da352653928b1d4a53e080204a69497a9a43f3c4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000dfff1b3a562844db5bcdd926cd8279400000000020000000000106600000001000020000000de9d122416cabd7b0c512f5b08e3be0b1116b911a8b0e6c84ff509979ce89348000000000e80000000020000200000003b4d7f9e2f41df014c261c61fb2c8399fed8342b38910e937b8f1ea4f755657a90000000ba81484e9e1700cf5bbf4840ea7b954d3b25a8f96cd67b738d46e2a6692d5cdd10c6524799a9407a23dfe3145070b3147eb9a71e19023d9969606c4a540573e57ae73bfb5f262c57ad0ea2d3b52aae054a9092d3043fa9671691da2dc477cbb435e9dfc58caa79c4de3800ff2778f200cbe6c4cb23d45160bb202b9db3769588ab2d509e4aafb81f7aca0f41e2fa6c554000000005e720852448faa11911d74aae33e15c173edc8159089f1dfdb3ddfe1447bc6f9fe2396b9e67c110dd81118ebd1452c15a67e9d7b5868bd126c3372b8cd53089 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2520 3032 iexplore.exe 2 PID 3032 wrote to memory of 2520 3032 iexplore.exe 2 PID 3032 wrote to memory of 2520 3032 iexplore.exe 2 PID 3032 wrote to memory of 2520 3032 iexplore.exe 2
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\closebutton.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8281f2464d1068f7f5f0abe140de117
SHA1d6ec66d645b2cacf414802c796095a1839b61a2a
SHA256d1f742edbbb1f6db963542a6b52eb14ba4f41319f1456bc963e9f2a3a1ddabe7
SHA512914e3ab8654bb53d3c4d33291d13d1a289fa0341b23721146026c0a702bf5ac42f7f6ce1bfc839d9d574c7c73da76d1978affeedbe32fdf161467bdd965698c8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGCFYHZ3\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
601B
MD5505326ec7723add35d97662eaea30fbb
SHA19f645fc66a6b17c797916bf881c15280e87dc46c
SHA256ba5ecba4d7d8097ec5fd23623251762171ba6183b03f69fb38213543c6ce6abc
SHA51264873741042895615e2b02de960b8e35c3301756c1f2f957174438e306df02cb60a8b8b1c117b50c8a56f8a6c979dca1e8fb7df24f28c479ae2900b10043f1be