Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/10/2023, 09:17
231012-k9jccaae7t 711/10/2023, 09:08
231011-k4bejsfa98 311/10/2023, 09:00
231011-kydbyseg56 711/10/2023, 08:53
231011-ktflhsee35 705/10/2023, 08:00
231005-jvzv4she8t 705/10/2023, 07:52
231005-jqs7rsbd65 305/10/2023, 06:28
231005-g8clmaba26 3Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 09:08
Static task
static1
Behavioral task
behavioral1
Sample
500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe
Resource
win10-20230915-en
Behavioral task
behavioral3
Sample
500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe
Resource
win10v2004-20230915-en
General
-
Target
500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe
-
Size
727KB
-
MD5
3bd2bc1fb2ed7ce223505556ee150890
-
SHA1
4cfd2d4f3c8c7359164eb79cf0830480d4793f1d
-
SHA256
500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37
-
SHA512
374eae32c1e803f468ed248d7828ea98b438d1377e21775beb5e0a477b593816ffa543d7dd3da94613d7e448a9d5557269f2c1b27d30726c85cf0a73f89883de
-
SSDEEP
12288:TcTn6DzlAr6n1X+R1vXAMk8Bm+r7uobOJ6+ShsoaqEkgOsS5:ATn0e6gA0w+3uVzShRag2S5
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d72dbb839895304dbc3a7dbf8a262ef500000000020000000000106600000001000020000000b87e7f8188a34663abc01ca3b3f5947528eb1065310fd3ae1f6fcb040c17a6ce000000000e8000000002000020000000c088bd384e10e2ef10b7d5847537268d12bbe8c138c418d03b46a6b9dce644892000000083133bbf60439978fa2b148e94c2d4ca92d1b04517ef0e61cc0cd0e100fb302c400000001afdf5bf7319a1681b12b0eabe275183f98cfdd459557181f9d673ff0ff5028cc087ff45f70a77ba57cbff46d6c92c196283a993f82874eb24e46b455d869ecb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d72dbb839895304dbc3a7dbf8a262ef500000000020000000000106600000001000020000000315e71b0ef383cdad4244771022d1680cbef4f4cb92e10e0528914e0bbbfc3dd000000000e8000000002000020000000bc627f0ebca315f325baddf585acdc6b881c2048e3771f40f7fe2c11f4645d6e20000000594b52f059a0d783d4b4f2c369c40e12facdafe76584e7b675cf9b0aa3cc57f4400000005d932a0d39115161a2e2c96d2731d662298414a957e29deaec16325acfba9c3c6b32a1257a045828993a0c718c7115f47bdc0f94208fd861317be2dd2b3c3eab iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ca610523fcd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{27502FEE-6816-11EE-9784-4E5EE4FA2397} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "http://google.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403780460" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\IESettingSync iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e7ad0823fcd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = 29de33f322fcd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4980 500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe 4520 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4980 500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe 4980 500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe 4520 iexplore.exe 4520 iexplore.exe 4296 IEXPLORE.EXE 4296 IEXPLORE.EXE 4296 IEXPLORE.EXE 4296 IEXPLORE.EXE 4520 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4520 wrote to memory of 4296 4520 iexplore.exe 102 PID 4520 wrote to memory of 4296 4520 iexplore.exe 102 PID 4520 wrote to memory of 4296 4520 iexplore.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe"C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4980
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4520 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3B
MD58a80554c91d9fca8acb82f023de02f11
SHA15f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
-
Filesize
3B
MD58a80554c91d9fca8acb82f023de02f11
SHA15f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
-
Filesize
3B
MD58a80554c91d9fca8acb82f023de02f11
SHA15f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize302B
MD5a09f0ee3e6d1b5cd3b6158e9ddaa3f7c
SHA1bbcf3a79d83cfd537e3cc8698c7d0b20379cb630
SHA256850697736d16e4af69890a41ddb906463deb8cc2fb1066797843f44da7b7970d
SHA5122ab3a6b1c03395ecdbf14ebd82b8b3c57dbbe7e30868ed279f95642d71f5b84be7c7e3b23b69a6abf4b8b5b379c2df7029eed19713da616b64c25d09a4ffa0dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize302B
MD58e70a461e9d426a11445afe0cf20b561
SHA1a9902972cf072c7d045e68c7fd0d8d087ff40d06
SHA2562426972cbb08f35e7bd98bd816a4bf849c46ff1eaba5bccb02501df71e69d90a
SHA512f1d754c183e899ae557d6443db0ad7c980ea4fd47d0c0c6e89c060dcc511cf2db8a4b419be32515552fb9db3f31e5c18451e2a57a04d795569881e5a15eba41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize302B
MD55dd336532666544bf3a780d0c4300db8
SHA13dc360e094eb994423b4be24157b5af980753e77
SHA256b18d77f3ecf32773468eeb4caf4962d4f66160da62271a786caadd1cf6760540
SHA512e7f24ca692f8651d711b0204d08eab032cddc57741ad7ee726ad14bb31b007985e1852c8a94f01f452741d8e52b99081029b950d1c8923534123fa044578fb79
-
Filesize
3B
MD58a80554c91d9fca8acb82f023de02f11
SHA15f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a