Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 14:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://rhcsa.linux-shared-pkgs.de/firewall_update
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://rhcsa.linux-shared-pkgs.de/firewall_update
Resource
win10v2004-20231215-en
General
-
Target
http://rhcsa.linux-shared-pkgs.de/firewall_update
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e69f79bf8ca7f55bf5b8e5d400f463e4942e2264ef0375fe7c435eb7d5438e27000000000e80000000020000200000001e97b958e717df387a14755a3dc76034a7e6980f9535a2d7442ecc9fb11f0ad590000000601b31f875b372f57ce5ffae8db536eb20e0dfdff67f8a905f18a79de8e780a91fbfe2eb08868fbcd2888bb3821caf9993845c8e078176892252ed3f72b7095b396ea3489339e0a0a034be4a304c4ebfac6f956b3da0f25a83e0e5fe4ca772085367177a48410f3f02ed31cb059dbc01cb1254b03b51d3f414a26f4cb2ce3e5d2fc3cd1291b44cb6183029b115dfb557400000002a860922763e063fe4281f73eb9b0a47889451c22cc311783c23b54f74db6834e770c98f2aad27058e594efd3ec3f07774d092f2ed2cce0bb058ccbebee2a0d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409588324" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000abb4c4f9741f3f13738ebac4b00391f1616021a4156cdec0962947bf4a1fc6b8000000000e80000000020000200000002480c18a797b62be9a28d74ac9a0483db4a01cdb4b59af745167d995ef27e83620000000a4f306b1cdbd56e1f338eb0cb3dd2a3f5fe9475c42676419813eca6074e52468400000007d7d162317b0eb7e817f1eccb6e402b79a9c2b00a344af136a1e0465c99fa6391ddc14a88478f82f96af789d6d2c83636a4b08d55f53140d4c4beba460a12938 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004815b07136da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB1F3971-A264-11EE-A908-4AE60EE50717} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2476 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2476 iexplore.exe 2476 iexplore.exe 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE 1736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1736 2476 iexplore.exe 28 PID 2476 wrote to memory of 1736 2476 iexplore.exe 28 PID 2476 wrote to memory of 1736 2476 iexplore.exe 28 PID 2476 wrote to memory of 1736 2476 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://rhcsa.linux-shared-pkgs.de/firewall_update1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce81672a6698e8145bffb3fa983c78af
SHA185fdce67416fcd1727b612b6015f419c97f342a1
SHA2566f69d45f09f3d1a60520b843d1d322239b6641e8d31b7e42568ae8587e46f0d8
SHA512d281e94de15442b084534c42187d68394e0d6bea895435932fd7bb179f98f080038d13c84e9549e8681ba4cf661d477b652d7151e2c07e66f1160d3d8637cc50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542d3b1609acafef03a5561f4251e03e4
SHA1ad91726e9fd70459256dcfa5a0458283c82965cd
SHA25619ad9f384121240f769ecf80dcf4fe21be8ee34c83274b70561278cddbd879b5
SHA51222307fa2284de903dc9c76723fd0111674dc7710024655040e9f2124f363d288a4c6dad2ff0526bf0ede6853ad606ceae4a12a454c1388cc8533948e59eb3b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b380f7770dbc435e0de79e355c19f26
SHA1f0e0bab6b501a3d78146e7751337cd875f7bc0ae
SHA256fad8c2e241108d3c1c44bc200ee0b06f0fdbe13b5947f61e1d8c1ae9130563e8
SHA5123196dcf893b2f08943f45e59da5d37f7aede05fa43050f31ebcfff58a1c18cf66af03f14c3690697cd695af966195cc07b54fcd4f5db5681f0c4c2a5b6bafb48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585bbd1c6b01c237278d75b7d237a37e4
SHA1b02ae2a2763668014ace244d0a5d3afdd5644fad
SHA25690716c5c43b296ec13f68794fbe3ca8f586219ac32c890ca953616cb28c7d9cd
SHA512184092a0da68ba308640660b997c2017242932928382ad4e55ab25da3fbf6659f4976f4efbf9ba6d24a4507a2f51489d95505ba52af30c4be944afddb9ac9a33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598f827dc8424cacd89887b24b1aa6016
SHA1a9dfdaa59af93850ba8f3157b03309daae6c7376
SHA25617e7c7cc2d92e8adbdd39e67b87e567d0b5642032d5ccda2434dd9806b760149
SHA51253a4af9332d80ca1595de9568138c7bed00deb14fdc3d3b72f1188a9655d2c6e8c171249c269cd9372220d34cf37cf294e2329440a374d08a67a89da1c380529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e1dd4aa83bf6ce480b57cfb27727c1b
SHA1d2fcca966d377f92c1f5b86103f6524f5e069c4d
SHA2562dcebf20efc8c89d2d26197316f5a2cf5c749aa50d0eb003a04149e7d5673386
SHA512082a758f49eeee8879a7b0bef0ba7e9e56d91a0ce4675aa960a37c7ba09dc9414a365ae682a288a2ce21ba8a7ba6eb42190a0d6002798269eb1054bb775251d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598e4548e6245a2e8073fd6633969f46d
SHA187aeddf1174e655a48f8883feee43023ef5b9138
SHA2566732981549f7dafe60d2522037635a1bcf6651f04d40f95f95b82aefdbb75629
SHA512aea921d4ebe3d57b80f8914eeb09cd54e90dab2adbf8bbe8a72c2c27f35d5e713948997f3cca2b40520e2d9e72d49100c308aa1a4de8d98b968b499ab176e288
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557feb443ced9bd1daf7bf0158026044d
SHA1dcb8d3b7ed4a80cf8c009cecdb6bf789fb8022aa
SHA25680c98a65412918058ee7ab2f90327d820f792f90f5d81abff2f972912bb97c80
SHA5122a3b03d63cab268da5f447815463cb8a239a6b9d51a470edfccfcdc59c7f2790507248472c43f6b1e81bc0c1a6f178a4386602200e5e5ace0d0f55b63a29a0c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4e0658dea2f70b60fee783d96464e1b
SHA182b804f0059cd218fe363deb5226bb58378e8519
SHA256f51ce5a8a98102a7eedd7a8099e7b723b3832a34f0cfb15837f9f6ac3eeb57dd
SHA51286d69b2cc4b28e0e551659ec569a65abfccc5e46c8b2f78cb5d5e811f8a42e6b874d2898c06376cda36fccf62a9c4daa1f4143190c1fadba070d5853858b9086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540e90009438c4e3bdb933ff00651600e
SHA1ee20c38fb95f83a495f975a546df48bb7d7078d0
SHA256a9d77790f38e4902fffa9ea9a9440b7ef3de6fed8cf667217c7ab4e73a29b925
SHA5128702176292dbc3354c897a073c377a28c98d323a0c72a8af781e90394471211b4b0d1da01e1707da742cbb6090b03cf1dd907675a8f57b6f74fdbff9cfb8d78f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1cb89027e08e34dd867aa5a114f08fe
SHA1e6c5e00d134b691643fb8f2671ef2ee62fe5fb8f
SHA2566b07042a820fade1f37a95de36e5bf83d6ac5666793d3c74eecaebc9fac2b95c
SHA51209a900cece87b4a2b8694cf755408229905e1a61e993d41c76a74ecc6a340cefeec7aba0b3176baf5cf425c0008db258cbf33a6a003390b871bad164e64a47a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdd87f33ea13082fe852dccc3fb19a77
SHA14d093889811ae9a75fd4487229b5c7a70c710df4
SHA2569b2b7238e7e84bd6071b1fde78f60e99c48ad573e5b8844c0bf1c26fc93acf9b
SHA512bd3bde94e022fbb13cb1575637702f089b4b664ea20777550cc59e8528818a41ee22c4383dcde3a3d10f0a0cdb2bf068a920a0899555fc342a9ce2b0904dd0cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55944556612b2dd184306135a6a2dbce0
SHA198c5cc873fad859ad495ed712ee660a34b1f3307
SHA2565c10a5f59b8028554d6adfd33e6b567d68e72704de72a12db99127b2057c08a7
SHA51285331e7854abace04062424ba83760c43b73fd77267fc27da3977711d9bd83eb704c17e415af7916e75a33a5c2abb33bcce08c43faf90769fa62707f1e337cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516cfb89eef25f2b3b66950b1fc9e20ab
SHA171d8508811fdcf4116ef5d8c4eb75193ac05f9be
SHA256a955fe70acc3956d704583ab420dbd10abc0d20309f2baad0e28a1c6fd5be00c
SHA512fc223acc7d32b3a0fafbfe41ca664c4f6d5b727e72c9dd8cabf278a758fe0e0459d993109741ebeab187e8b34925d915364595325ce526b0f821850383a19b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baccfc3727228073d990f5e33dc03e9e
SHA10d7b8a40c146956741524d22d2dfef04aa7be022
SHA2563a6ec54f0916aeb740c8604c024de647939316ccc9aa4b31b8c88da25abfbbf7
SHA5120aa7341bb63e48fb2692ba9555b9988dcf930f3da874b95213f2ead141407463eecb5fcca4bf4612b28df0fac85b44020346078ac4c0c3d4573f12d835997acc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517cde865a408ad607864e15f3b1c381e
SHA1e7deb9c82c4638fa10756dcb6c4f22028d2fddc0
SHA2562b5e5dbd8142e7466247b2a7a15cb6067d53c0c6be6133764ac0aec8c816ea52
SHA51242678b78f4ffc4d079098e02dbddd7f455deca071f8e5c48c2fec1e8c18e6defa8f98d8c27682f0cb00290eda78cd3f5df872c7bd43dc642ef769ecd77840a18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506b0ab46a3f75d23bfc000c461fdc025
SHA1d094b8e59ca5903e764baa504720e0d6620eb089
SHA25699a53aa028056718c201325841c67bc696c2049df11f4a1bccc7c6b064d5b102
SHA512c05747b424e7445d7916a311846b63b718757a76f70ee54793b2a1f127d26f9cc82a489e042b02f7b26a75a372af09cd51a89a616119387490fe334488c09c1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ae0f78fd5626649c71ebd334eec90a6
SHA1c08ec020d51c6560fcdf852ba2d68ce9d05f79d3
SHA25699486f947fdf442d500c01e1c070a98cac8d1069cba032791b73c535cfcaef55
SHA5124cc95d3afa22ce7aaf99b800090808e2a4208d00e578c99a624ebc3f6a0c15301e545b8d35c95678faabb0f38c15f1c51e9331932bcee7ad562b2261cd555165
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595a8adf46045275b2cda0988c0f4d385
SHA1ebe993c6f7bdf98e7981d59d164369e877b7545d
SHA2560440a21a0e582985981640706a887dcadba61aeaf4d6df1422d98599343ff09f
SHA51232dbb85e70c18c40ac34bcc76c964a0eb08e09346d78fdd8a56cee972564c3df5822573d86f37e1f5744e221b1b82bdc771bc1a44081e6ad94e91d1457955f53
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06