Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
4BINDInstall.exe
windows7-x64
1BINDInstall.exe
windows10-2004-x64
1Bv9ARM.ch01.html
windows7-x64
1Bv9ARM.ch01.html
windows10-2004-x64
1Bv9ARM.ch02.html
windows7-x64
1Bv9ARM.ch02.html
windows10-2004-x64
1Bv9ARM.ch03.html
windows7-x64
1Bv9ARM.ch03.html
windows10-2004-x64
1Bv9ARM.ch04.html
windows7-x64
1Bv9ARM.ch04.html
windows10-2004-x64
1Bv9ARM.ch05.html
windows7-x64
1Bv9ARM.ch05.html
windows10-2004-x64
1Bv9ARM.ch06.html
windows7-x64
1Bv9ARM.ch06.html
windows10-2004-x64
1Bv9ARM.ch07.html
windows7-x64
1Bv9ARM.ch07.html
windows10-2004-x64
1Bv9ARM.ch08.html
windows7-x64
1Bv9ARM.ch08.html
windows10-2004-x64
1Bv9ARM.ch09.html
windows7-x64
1Bv9ARM.ch09.html
windows10-2004-x64
1Bv9ARM.ch10.html
windows7-x64
1Bv9ARM.ch10.html
windows10-2004-x64
1Bv9ARM.html
windows7-x64
1Bv9ARM.html
windows10-2004-x64
1Bv9ARM.pdf
windows7-x64
1Bv9ARM.pdf
windows10-2004-x64
1HISTORY.vbs
windows7-x64
1HISTORY.vbs
windows10-2004-x64
1arpaname.exe
windows7-x64
arpaname.exe
windows10-2004-x64
1bindevt.dll
windows7-x64
1bindevt.dll
windows10-2004-x64
1Analysis
-
max time kernel
189s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07/11/2023, 13:52
Behavioral task
behavioral1
Sample
BINDInstall.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
BINDInstall.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
Bv9ARM.ch01.html
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Bv9ARM.ch01.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
Bv9ARM.ch02.html
Resource
win7-20231023-en
Behavioral task
behavioral6
Sample
Bv9ARM.ch02.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
Bv9ARM.ch03.html
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
Bv9ARM.ch03.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
Bv9ARM.ch04.html
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
Bv9ARM.ch04.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
Bv9ARM.ch05.html
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
Bv9ARM.ch05.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
Bv9ARM.ch06.html
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
Bv9ARM.ch06.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
Bv9ARM.ch07.html
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
Bv9ARM.ch07.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
Bv9ARM.ch08.html
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
Bv9ARM.ch08.html
Resource
win10v2004-20231025-en
Behavioral task
behavioral19
Sample
Bv9ARM.ch09.html
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
Bv9ARM.ch09.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
Bv9ARM.ch10.html
Resource
win7-20231020-en
Behavioral task
behavioral22
Sample
Bv9ARM.ch10.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
Bv9ARM.html
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
Bv9ARM.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral25
Sample
Bv9ARM.pdf
Resource
win7-20231020-en
Behavioral task
behavioral26
Sample
Bv9ARM.pdf
Resource
win10v2004-20231020-en
Behavioral task
behavioral27
Sample
HISTORY.vbs
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
HISTORY.vbs
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
arpaname.exe
Resource
win7-20231023-en
Behavioral task
behavioral30
Sample
arpaname.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
bindevt.dll
Resource
win7-20231020-en
Behavioral task
behavioral32
Sample
bindevt.dll
Resource
win10v2004-20231020-en
General
-
Target
Bv9ARM.ch01.html
-
Size
24KB
-
MD5
9dd8912adac6508b3e21d0b0695fdd14
-
SHA1
a1f51aa1a73540730b27797429a30da6893ba913
-
SHA256
6051d7396c7f17e0f9a2597838c63bd201a46befcf41b1459bdb4c61198a4634
-
SHA512
b7cf59d5df3463af78f28a5edbcb49eb647c32b97c529075195d08847277eeefac25131983b405a04401e55c58a816af5d3f3ac4c9028f025b9caf97ea7a1b21
-
SSDEEP
384:ZyvOXFYNRhwYbTYLztAD4OOZASl+X186ggGpZ8W:Z0O8WEYdZA1X1WpLJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405546676" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e90000000002000000000010660000000100002000000021d6523c1f5ea6fda1e268035092354bc58b635c41bafd4ed1ec7bf086dc0bd7000000000e80000000020000200000004af2efe2fa31acb11d6262816faad9fa1040a9d7e3f443a0bc4aec7ba2c8141a90000000db71b164f83c032e7e7db0a5e1a673dac9144e59af6a22477ba8f575f40d81656977b1aea7f12c927f627312de8354e9cad23ae3b999b68677b01084d5390e7d4ec9bbd7875842e420cb47c87c71c4db333bceed165ceb9aa8d5810cd04d5d18f87ac9c67b208c924e6d60625ff34d27de9198c747d6a847c1bb74ccb3c2096d6650cbdc86c8f47228b9a2fb391c6aed4000000035b5d8bc8b8fb181d2e258d4d607cc60cbf06fa935a237e1f060ffa6d2cf8be3f64659eb1abbd2429dface890f6a78f54609755decdafc7334a58257a3809f0b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a4f07eaf11da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000006905525a4751872ef5f3339396477cfe7a09b5604d8fe63799adf03f6ef5ef4f000000000e8000000002000020000000df54bc75c88543840df5497f697c4417681e6833ee9de98cd610960b5674bf292000000034e6152ef01ce0c2779424c6fb7ac556beb797a9c7cbea819be36e3797406ae9400000008cb929e9ebbbf5b7d2bde9241c34fc297c41839e8fbb36c4da42ef543da6f6f7f902a447cd1833d4fe257630429577be4354658170d328209d57a105ab282184 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A93AA981-7DA2-11EE-888E-E6337F2BB1FD} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2732 iexplore.exe 2732 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2140 2732 iexplore.exe 30 PID 2732 wrote to memory of 2140 2732 iexplore.exe 30 PID 2732 wrote to memory of 2140 2732 iexplore.exe 30 PID 2732 wrote to memory of 2140 2732 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bv9ARM.ch01.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eea2ce5e825cce4abf225a3c626d1728
SHA10c3d54cf2cf3017a3e399de546862be3c04fba34
SHA256f46542941451a64976f5cc34a5e22454481708db688b933b89826981d6e80a26
SHA5121366502e9b9c2fab1b230a20d9373f06fe3ffc40090c411ae81b27abc90602f1fb477815d70807da85c5d7b1cf3f6dd67c9fe0734e80002cc791e4f9c8627a59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530612ccf778e72fdcb72f0d63700e9d8
SHA1dde8be869bd1f03b9669a6d103f70f7c3de57ea6
SHA256714e28abf03f16a8ee7ec304725de7e596bb42d947ec8e774f44e4cbd94c3529
SHA5123be8ec5a5b563747f06857ba1ea962a35cc190a59c5496574b23b7cbc316273f3d5654eebedf8321fde9fb1c23787822ce4aadb2846955bbf1f074a19ea1a6e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c387efebc586c918ae5215a9396106b
SHA1a9a5a5b12617460c73dddba712f4b07962258dd3
SHA25635917941674b5b4def84336f6bd9998af323285c394f9a8e10228a41242fba44
SHA512c9bb8ae96f1354c95d14b60a7f22ef69652cd6ef54879f87ec901475fc17aa610c9d9081fc008f34ec3a45698347a40b178371ec76cd9678b361a35bf3ca8004
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5973726447b17c03155d3ae3896782540
SHA126a0c45bc0729b92fae9a9315ad21d962ae77175
SHA2560661e72256fa8416f008c66ac4485e76c6330e1dc539014c1036e77ec520361e
SHA512520eae95a70eae778b0bc34056e67fcc70eb1c8ff45b2ed5a2754b6d25bba608e5e53067d5ea3dfc7724d0f1b7b8d18a1801fa33afc280738c4acdde9d133782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8b95e5ebdeb703a77e060795d254591
SHA1d5c22595b240109158aac3e9adf841c3f07bde88
SHA25663ccbdc40b27f36147a2c31ce11d09d5de79f5606a6ef3b4c7ad48895e7302ba
SHA5125ab19a0d1649b630b48089ca6f70562a2d69ea0705af92eb687dd834e015d7a93db27e61d572e4bb1eab0685e3087cfe758528e8ac8da3555d64616657a08d7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590f11d2eb9b2a425a68063e3ec7f6c1e
SHA12fbff7856aaa9736df64506592df4c734436776f
SHA25628f72b53c9d10e999b29323b96a049957ef0b6f0d7aa3ae17207a46a3c078926
SHA5126e12320c955144079e9527efcfb87af02d717a4f4acfdff280496021fb9073e63b981b5b63fae4cab8d4c308ebbb2ae5248cf94eb859aa002538ccbbebbb4ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545e7a3e380291685ce92c738434a38c4
SHA1fe7c6a7bcca7face9305683ae805424c28d017ba
SHA2565b3f284388bbb2642d9381a056b9a3e36d701d124780e0e869af13f335af503b
SHA5129191196c2091d50982ca8e0bc36fab9d859ad1093c8e96f601e5f9228f0f3a975222dc39717c7b882dadafb9f7195f73772d18b9fdce3911da5fcf251a1b110a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b02c1263cfddc51f2576a3620954f1f4
SHA16d75309f8c263803318266992548ac786f195016
SHA25630f6a267c5046788653d29e0c3406b0c68fc56b3bed15cd1b1bbe3dc8842c39f
SHA5120ab6ed20f16f4fd514649ca24d4a2664802f1efe47a2278e76683ea3ef614998a2f5cbb09b5f290ee6d2b8d1bb02a3d50cd1bef8acb398dc9e881374e369b748
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50344707f923fd8a4d7f7eba083876b24
SHA1e479fd6911db7f909c8bfabd439a2d69f6309de9
SHA256abdcea261c075fe59954d7f952561d86d985d19bcbc71f8e462aef728f3826cb
SHA512895377f30acb84c58e34dc7d478d98d49c9b8a7b8cc85410887727bfbcf4f0e0f40194dd3ab7472e210b1a45501e094e1c023d1c745692b24049050cb8dcc23d
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf