Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 19:37
Behavioral task
behavioral1
Sample
bnbz.tk/bnbz.tk.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bnbz.tk/bnbz.tk.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
bnbz.tk/xtw.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
bnbz.tk/xtw.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
bnbz.tk/xtw.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
bnbz.tk/xtw.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
bnbz.tk/xtw.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
bnbz.tk/xtw.dll
Resource
win10v2004-20231215-en
General
-
Target
bnbz.tk/bnbz.tk.url
-
Size
40B
-
MD5
ac31067cced37f0e7815bffacb3076d6
-
SHA1
b4c74eaf9aa126191184c4e8ffc4309fab0ea544
-
SHA256
8541670fc1d8e85335d766d8d7a30afdac9d13a87302794109e0f9b89e4849a6
-
SHA512
9ed865d0631fb55ff62ba0c5dcba0cafb077b6ae4f17de509281125655c31a430421dc2a3d1f080c2cf2f62d17fec70abb51bcd246f1c4664eac84624bbd1c69
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27DB4AE1-A41A-11EE-A62B-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000005a691c24595be83a2c2f650bb4c6ddd2fb9ea5892466babb02ebfb7336a22586000000000e80000000020000200000000d69e4780fbcef2504b4586e1151b2dac59f622c31453d5592463cb8c3c85d16200000005b53950f872102ec78c027d9c120112d1c8f04dd6fd7dfdc65185bc1af98d71c4000000065b43a862a1ae54118738db2e1609c2f093d13177ac681f6747e68090a67c3cd558973a7b306bf35d404197a123b2e1da5ccd0d253b8483483898fb4e0ef4d37 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000e75bbc1fe8391b2d14762964cc2a9475060dbcf351dcb6b084828904fbb3bac3000000000e800000000200002000000016588d9bbdd196ae7d23731b22399526bccb1d33bbc2e2fcce125d8e7390c77c90000000b1b0c90f72b4526bd164088e7201b604a60b8fd417691bbb1beb3e81e83b4525520dc2bfea9e50e0359726743985089b5c1515ea6d1bdd2406e450e0fd1e8c580d1478f8b98339c9b892ac7c4e2921e1fed277e56f865df7e679d5dc5f17ba118582399d0c33f72bba91409878ad035e5bc4b2cd67c3e498fd46b30fc63736f815da0b6710ca55f390460dc6147ef1d140000000752d80da50425772e5b10fd670b44a7a28f3b0f4fef09c29ff42cc1fbf458770229255dfce2a7e590872124d9ba31863b465d7ec1c625f25c65a0b826180cb66 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409776149" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08c48022738da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2808 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2808 iexplore.exe 2808 iexplore.exe 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2860 2808 iexplore.exe 29 PID 2808 wrote to memory of 2860 2808 iexplore.exe 29 PID 2808 wrote to memory of 2860 2808 iexplore.exe 29 PID 2808 wrote to memory of 2860 2808 iexplore.exe 29
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\bnbz.tk\bnbz.tk.url1⤵
- Checks whether UAC is enabled
PID:2888
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c92c685f72358955b380f9e6bf8dc58
SHA1e52910b78e523925f7c591e8236ecd5e100b02c7
SHA2562ca527af185a9f3294eb11e1900d69f1be038f603f9603b6ac66e86e12e8721c
SHA512823a9600b1a3a34195bbd5a75facb3d1dbf13bb33bbd0452d8d8dd9427d442c583f4020a0a4c937b7848a9f6c147effe26c0739a49df93ee085904982ad8944c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50395660dcc360949068424432345a399
SHA1d2851d91deb7c0c8a6e5f87b12293c1f527822cf
SHA256279cb161795133af1cdeae17905cf6630a6904e865dabf97aa20f74f3d7d546a
SHA512b077f5a86392ee837487953a3871e495d3a983cec8b54cb4263242513b5b5a40d8b320cbb28ac929a8e8f7612df985ab3e1b5e268d065508fdbd3b1b51abd105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c6f3ef0b47d371abde9d24ce087d469
SHA18ab89651bcd0e2e0abbed6b74e9d12ee604643fc
SHA256f3a2fbb5c048ae0fdebe8d1825673e21f9f9537d7898687e912a09631571433b
SHA5125e551cb669b73fb7d6ea02609b05e6846cb0534b264c79cfc43c5640b9dcbed630150055de13ac27c8814ffa7fe65e2b9a640ab2ced845340a33a2d3327d3659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7e73848a76a578f9ecf9d02564d99dd
SHA1f50610de319239591824d2a85511694b94a77ba8
SHA256a5e91473bbdf8206da87c3d5f204cbd9edbad9a543e37ceea20212d0cbdefb8d
SHA51274c5298cdee2d2ef8f0faf22b946b6fc58a3da2c91012cafa6f75436406050252872832209355fd923adabfe0a3b651ead5cddb7bfd65fd6677c3c6dd38ce9de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4f88b89449222da527dac66ac6136c2
SHA15d431212c3872c3ae82d5a96f2b268e2cf325b46
SHA256f6870a07afb07d76e8d30acfd55ee90350386affa15076ad57eb3e240f1362a4
SHA5126d6f3c3b5bd5fb456a93f6a22cf8a087737d074c57ec248aa0ca84995615efbaa20107a8d318347e8983291dd31197dd91d6f9822f33b72418a4d8d3c88461e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d64e70d664fde1979467ca7df2ff79f
SHA1eabfe2f79a64e7044b7f00e21db19b37454b2957
SHA2569da68a0cb3a3c2fddaa6ac19697bced87d7cd095e9377ca16becc4272565b93c
SHA51293df7b88a3fb2a7ef99d74271fd0bd8b9ecaccd57a168cd0bc95c9c617e9e68d2360acd358c8d37d074a0b295aeca67cf49b28cc88579b80019d197206fe0646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e48ed565d4248a089be666f9f2e0cd6
SHA1af557123b487e14ac80dbfe2075a245ac051beb3
SHA25642e42048b749a04287b8c00274a3cd0ff78a48d100683c6bafe78468a206512a
SHA5120921460f9c6562f33806717a875bf82237c6e6ec2b7172986f2fd496f4518221e5d93294dd4ed599a18de21895456a4de55c60c9de06dff852b1f9ee3d481f26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcb38a964854089da9c44823b9a61ac8
SHA1187f6dadcc2381c78c9240193ce1565d45d44a13
SHA256a254d89c4e9aedaebf375a4ed7c1d241e49e18ab75f94efe6f54827285fb4f44
SHA512b1a734d81666ca7fc3c2a326c3add2a6fc85123988b7bbe59a0672c5199890a84b8fb1f0605568a64a3fad9167e47ae9f94d0e976f781559e8c2680bec620496
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06