Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
38s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
11/12/2023, 09:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://amendbendoz.com
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
http://amendbendoz.com
Resource
win10v2004-20231130-en
General
-
Target
http://amendbendoz.com
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50FA4471-9804-11EE-8B87-CA07A0C133E5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE 2984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2984 2956 iexplore.exe 28 PID 2956 wrote to memory of 2984 2956 iexplore.exe 28 PID 2956 wrote to memory of 2984 2956 iexplore.exe 28 PID 2956 wrote to memory of 2984 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://amendbendoz.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dd33c83254dd8617d2806879820be5e
SHA1a430dea06145bc6d711bad8e43afbe364d70c88d
SHA25631bbe63a70e26c511b5eec53ad3387a40bf62ff3f03cf173c996f87901694247
SHA5123dcb7f140440d58a6b5e18314ca2a22078699f3530186334edb749ca46df9fbe8a93b3eec0d43358154451a4261f67aee7c989beb73266a254a53e7671c93ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5949ff35a3393f57cfce2e5d7a923bf98
SHA1f82f8b1fd266542b1a01d9658750c78acdcaa576
SHA2561dfa4b70d85be618afc99d0b288d2fae66f5b0eb29de2e9f3e0239ea4ef51a92
SHA512350539b06c53d9251031ffc92210d1771c1f15103bb742a21e92abbf907699edf4695d0efa3703aefc7dcdbe49142a76f3b3a1d5ed96f88681b39e025317cee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e99bf200d20d85eafe5757543189983
SHA142f0f25797c6d4f25c94e2ce90a28b0457bada45
SHA256c88f3c5057d08a78c353a6990f012bc596daf7467e0ffb15e00b49ba9bfc306c
SHA51241da296cfc536f72b8a7a58a5203151394ac003ed1d8461670ab370c7c08e1f5643a48ad23ef179c87608dbd2cb97845afd52ef58d4ebb34f7da4d31b78146a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582f6b779e96eb86fa1073a40bdf3c314
SHA11b7d63693b6599c8ef0667ce6198f407d079a082
SHA256f0d4d39989688cbdcc8e4829d25ebf80bf7a5a68f95939f6f2e3e31dbabc796e
SHA51271e61c477ab3a386649d2e615da551519864f7c5f28a65d558ba3584a72b945d3b02d01d2c6348b313fb4a2e7b6172d5193c8251193f65a77e1f64cecea3ad06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59daa20cdb2aca7df818c15a9871d8336
SHA1f043730dc102729a16d37bc7834072924ef0ef4c
SHA256025d8bc463cf152da901bf4387e38c0415cb4a71e3d7ef82e47a5d49dbea60a3
SHA51250567a8fabc20a2057230dc8ddd6f38c1e098590d822ad3ff7942b388ff813de747fe8653418e9a2c9b7c732d4bd910d3cb7c17dd4a32c8729da5113c04144fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55701a9258eafb39f95d8b90bb9abaa83
SHA175c448beccfad47097ca27894b3b176a0a2d21f0
SHA256fa39ce28056653dd783d966ed77503b515c5e5f441f6021d45d37ba4e1e93427
SHA512a7dece5a6675fa8422a15e33ae5ffe9fb978c5d60943ed3cca8976280fb3102d2a9afcde64468d4370bff79a427b6b2ae84e22f0ebf1738a2a2ec51c81a24eff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9f81bbcef5c2b275dd16f12b377ace7
SHA107c6427b650af7c31bfcde0c627379fa8c78d424
SHA25674a6c1d8f8ae70f669806ea7490b395d104a8b93c9f9928bddd00598c4eba4d5
SHA51209fae2ddefd569f4879b483f32d90892a53668d512d1fd84014e188c90c00e36260b72da87ac0dcec5b288831f357512aa21342132850e9448c658cb5514a2a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59788af658745a39d1d744c720456f61c
SHA1b0b29854aacc22865465396f02a919823c0cfe96
SHA25641495c25013ec739f2ff48e5f2a9f28f9dadd48f8ebfaaa5cc59f0afa24a4efd
SHA512f432bde1da301599590aa967ee0a8fbfd495655d9cb9af688693638bba9e60516371fba0d455bface5a5de15482c1364ecdb42e039d402b439742f5b8b0772ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1e8aa5619b59493170e22713aee0268
SHA1107447ac6345b97888c31611b4c11364afa3075b
SHA25660ffaf20a5135336189d052d78097298deae08622ec17f7de1fd999b1fa23026
SHA5123f83e33f0a7f2e39cbbd2924d8d67f2c270b4ee30d03d98a790f37bfaae5016cfdf0e9dcfbb0adb62147c8b373795e7b2d3740445c206ae24fc43ca8b1123d1a
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06