Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
25/11/2023, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
Spotify-v8.8.88.397-apkmodget.com.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
licenses.html
Resource
win7-20231025-en
Behavioral task
behavioral3
Sample
licenses.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral4
Sample
quicksilverCardAutomationInterface.js
Resource
win7-20231020-en
Behavioral task
behavioral5
Sample
quicksilverCardAutomationInterface.js
Resource
win10v2004-20231023-en
General
-
Target
licenses.html
-
Size
1.7MB
-
MD5
19c8a87991033fb33fc299a48482a20c
-
SHA1
57dcbbb761718e21ff6f462dc12753f50bfbf30f
-
SHA256
ff0afcb2a25f48f9cd12758cb0d4c0fae9c24420cc5448b51ff5f0bd81f25380
-
SHA512
f0288466ff69da8fd589348085a2124af62774e900a142a1a5aa013d8ecb46baf31329e1b6c77ce07786cd6c53954aa9fef3a4c56ddf195f83b2ef933cda7891
-
SSDEEP
12288:V03V34k3P3D3A353/3q3w2w2FDS303w3e3w3a343H3S32323+3n393C38303J3l/:Mxp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20445f4e4d1fda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{792C4401-8B40-11EE-813E-DA10AE527D6C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000acee3781d11b473b32176d51e33ab1be15159b6bf7f2fde339347fa9132ef24b000000000e8000000002000020000000086a0a76b307a6751d49d62d11248ff46740effcf29962eac3ff5d175192f74d90000000e1c1779ac75e7e502c426c14757883dbac5e11dcb22f45e3e01ccc0b2ed0e3be82e1ac3248cc590435f23ebcc5f2d51a126f29ef792541abeb9821c2c480dfbe567abfddc75893e3ba13176d62a72909611375295dfff6b91ad37bd7191f6200431841e5f16bbe358300367742798f94c2e47dd970788f57208ecadf3745434a59c9931023811a2bf20d548f4daf2d58400000005c2e60cdc05e26d92669bc49b6e194392292954e54720ce448c4a865e79cedb4f267ad190c3de6867ab137b3ba718a3985484bd96969641db3f37e127ecba8ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000006b8e049dbbb1fd857da9ed6ec6fed07b23fa5fd1919b851601c3269d6d46dcec000000000e800000000200002000000030a42463f44fa48c0d003ed5b2e7c0872527cbc83fa4fcf167e719f188bac4972000000098acf4529b4c28b24dcbf594e9a2679fdce3fae5c02e4fb606baf85e9c8660204000000029ad5ca13493bf9578a2e98682044ca23d39a0f485eb1662ffca69bb22cf1d69c4f68acc38fa15b65d3cc3709e4d2aea1c19d79f4033a232662af761a3a387d4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407043821" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2944 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2944 iexplore.exe 2944 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2944 wrote to memory of 1720 2944 iexplore.exe 28 PID 2944 wrote to memory of 1720 2944 iexplore.exe 28 PID 2944 wrote to memory of 1720 2944 iexplore.exe 28 PID 2944 wrote to memory of 1720 2944 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\licenses.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d62f61637607b34cf0a06130e4418b20
SHA1629916467e4fa82d61aaa41eaaa58da5eae4bd9d
SHA2563a9a65ef4ebfe3d23ad6446604bd3736da3244d22c00c211512516e0c557a632
SHA5124be720b73e072d7fcc1280ccad462923ea46e82eaf3def5fb06ea7559efeedee5f47e6fa54d38923155b6db12e675bce6cfb9b3540b181525d8f65b97753ca39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51474856b3c01b7304a285ae9cb5001a7
SHA16b0092d4db9c8da7a5b6b2de669ecebcbf53c76a
SHA256de5ca2e09dedd26de24237b22959410a2d1e7b1716fbefef845a34461b257688
SHA51213c6d159112dee8824f81e96984c3268d8528bb1acf254913f43fe4f29db0130414c9e5594f90f4a316af057e00401f9f24a503cf1c33e4f9f07342cb2a3132d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537d2e25be1a758d490210987cb7e4c87
SHA1466f081e0c08bea4dd27e422972fde1db3b31b45
SHA256552c50dbee09900a3c237eb971dcaa817b499ba2399b535c0a9e274324774303
SHA512be06519baa26d8a9bc2679522bf634372865f2629c9108385fabc72fd07358d0cd199d863be1e3931fec7beac0524ed9ec6e942aed56263c0c3047cb5a815014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56acdbaf9375dec4c8831771d543fa089
SHA154e4a668b034cf4dc300b0dbad303a0e2878bc55
SHA256d017da18a2cd94d1358ef27b177d15285b91e9ceee8f8f6883748eb0fd394a7d
SHA5128a243d97e4be6c3ecaa295c1aad2e7b0d681179f88634f5f263b947d1cd0539d2d0562f1d28ed7bb272ae304856a44720475e00baf4e69b52a265f1c1a8add12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570734c98ab2cdbb3b4c6561e70625649
SHA1bffd6d7860d9d0ddba06f23a3c600fb65e87f0ee
SHA2566cd091ca63a2cc53a028b9e8c1827a3729ff4edded7e12f8637e7c1163e745a9
SHA512e7fb9e20824a4f1c0da055873d579666f465f83a66a05ea7ecc078ab969d2d207219db48e366c8384b4fda6a5a8541e208b549df48e48b0523856efe4416c105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4c78ae521486b285c35b86cec802653
SHA1d4b211fd5538101765e5bcecbf4611760ad424fd
SHA256664570cea7b837ea1fcf44e1387b410bfe9aa0e725080799e1373ec75d389e23
SHA5125fe6ba91b98a60c1ec2883b1b04560e3a5b3691e6a3b7302aa90c904d3637e31887608cbe02bc76560f5aab05781b0b1e4fabef8b581f4da1d138e19b2d5697d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f27b5d08438e0166d34e7b47006963f
SHA16d07335622cf060df364cbffc5afdc770b24caea
SHA25634f5e872ad4f0e1bf33c07713209fbc0db744392678b28e4fd66480be24fbd02
SHA512f318e8c346302a89be97a9d1bb80d8fd275011cd4edf8dc57ea7c8b43e468452813fff06b7d275a2628472bd9319d68771f6241c6e359ddcd852076e346c368d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e39817211c454833737a0606a98f276
SHA1768183d11345e8aeae2d2f8e32dee473f07cf329
SHA256fbb9780ff3b2052b3a8df1ae01addadea77c3fdb801f433b2ea80973d9cdc28d
SHA512188438fce5926dda47b23750db23b9dfad4f47ff267b5dd454f65eb63743dae7afda877054d8768b599540d06edd8915fb9dbe0a510c417904fa1140b41d867e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f0efa289acb6a5c44bde3cd133fd198
SHA1f567db49c9db1122c78f7245d28b5050d7519e6a
SHA25691c04ab997d840e2002bbf418bf1d6fff625d0a506d78a60e5674924dcf5bcb5
SHA512b29a3408b35a5c2c053b362c8ea342aa00d269dff8721a9621e73343195f6a3dce8159bb50dc394088560a2dea969f837c12d36c62a4553fd0379befc739e37d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549f08397489bc42f992b79e536ff6b6c
SHA1ded5050a5588f24d69bb4b5367338a61ce93a3b8
SHA2569e8b5858c54ef65cc4035c2562740f44a181cfe681653e8d3f6b25434694ea7e
SHA512dce01865cc1f4f50a2dcfecdd5ccea82ec6a6340c105ba64b847804faf6735ce16123230f4e8ac15da6f517943c4667578c7b00ab8fdd01faee261148ce6d79b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51235171dc0881fc01041d0bcbb035f01
SHA1244c019eb5f97639904e8234f32ae229823463fa
SHA2568dbd257b992f3f7fc21016b6f9399ecbdf21506151baffd66b27bad156046d29
SHA512220694f44f3b9bfe36bb70b234815ea89ab62f25fac748ffb39012e155fc18be3a170f98bb2de94b63c08b9e252e3382cf7dad2e35eb20b78bfb35086bec3090
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe90d5e1916aec6a3c47cb1aca7dbb78
SHA1d9e26ab562fac93dde674748686dad489e4b9144
SHA256e18addc1b1b30f305ff632f44610ed70ea1c215a2c184e038ab3f2f34c039c42
SHA512f6ecec64e425acc94582cab2d7147d52ce51cb664414d9819f5c203651732756b4d071df3eb8581a1433510b2e6abd4f99dcb0165bb32f6259cb833495e1c0ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed2205738f2fe650356ad66933de49eb
SHA10eeac5b51c99e40fd1f338649ff113ee34089aee
SHA256a9f117b7f1310682eba1d975b9e51015094a66ef0be2e0b32e77dde6306e272c
SHA51206b97c3c97e32855f51da6d3adec9202acecdf7213f748970dca2fb1ba101ebcaa48998dc4027960b6163c5035fd0815b9fcd1254ee84c233b001993c8341062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5160ed5eee0db0850cc583e9c50b3fd10
SHA11cd4e7645cf0fc35ae72c372a5dded0cd1026738
SHA2565ee2169977f90b94da8c2c3798b01f59e81b6d543593af0c8528a190e3434b5c
SHA5121aaa930851e7d46a2f87818e0ba4592db575a60f2edcbbcbc72f464c3235b3bc9a2a872bca7e6bcd64db13b08f0c940664e441def5e893e5588227855ec60bce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dccfe5029cb5399fd10a18cd1c22bd29
SHA13a3d31e9f449552e049ae58b1dd162d94042bd3b
SHA256f77486b23cb72545670d8a975cd3d984e9a79236ea36a8758ac97c3033ceb694
SHA512eb0c57c4ee98d8f9233bd7075f1f917c763aea1aa51e104660c90c8b7bc0bc1da0d7cc7a02843d56e22df77ba80f1713729dc62e8d41850811945ee1bb5517b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572cbfc91d7244d1de8065016773df7da
SHA1c8b0679873e4291ddbf4cdf5d4e9fb5a8d41954e
SHA2563660b41e21f8c7be84a20b8699789e43beff401896e9e8d6b4271fc7a8184136
SHA512a51fa0f7a3c131ad67163187d85ce62ed2634ba50004f2b1479c08596e8cbce23f8781bb9fb18c8bf0e3aa06e8ba7a2be3378b0c8e5bdd41235336a7895b5661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d505b0eaf6e80a20f4260ec433970da
SHA15911064b7f3cec49045b17181a23047f55af7215
SHA256542c0a034beaae5d302a2e1ea59ded0c05f9280d33e56f5d2091ab9429602550
SHA5125ffd7ce4f8f3078518f83adf19cb38bd54095942de27dbf24c9036fbc2dce5e9e5f54063861935b2eafd8d8e96215d13d76f8d6c8b3f9b7ddde2ebfabcc411d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576bcb48f5d186be70cbcd4b6f645ea23
SHA173293ba48569784e41011c216b08c915842099b2
SHA256a4eee6d5677a76680dda3a8f23a54075f64a5419dc527634db94e2b2e3e37b54
SHA5124e625f4d3638f3d4d03ab8e43873f92d4b21fcab7f01b54f28902f794ab6018424b150a04d525220815b2052183ed761972807df58c4bf3df57a57c686999d15
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf