Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/01/2024, 14:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://sedoparking.com/frmpark/atlantichealth.com/skenzor7/park.js?reg_logo=netsol-logo.png®_href_text=This+Page+Is+Under+Construction+-+Coming+Soon!®_href_url=®_href_text_2=Why+am+I+seeing+this+'Under+Construction'+page?®_href_url_2=http://atlantichealth.com/__media__/design/underconstructionnotice.php?d=atlantichealth.com
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://sedoparking.com/frmpark/atlantichealth.com/skenzor7/park.js?reg_logo=netsol-logo.png®_href_text=This+Page+Is+Under+Construction+-+Coming+Soon!®_href_url=®_href_text_2=Why+am+I+seeing+this+'Under+Construction'+page?®_href_url_2=http://atlantichealth.com/__media__/design/underconstructionnotice.php?d=atlantichealth.com
Resource
win10v2004-20231215-en
General
-
Target
http://sedoparking.com/frmpark/atlantichealth.com/skenzor7/park.js?reg_logo=netsol-logo.png®_href_text=This+Page+Is+Under+Construction+-+Coming+Soon!®_href_url=®_href_text_2=Why+am+I+seeing+this+'Under+Construction'+page?®_href_url_2=http://atlantichealth.com/__media__/design/underconstructionnotice.php?d=atlantichealth.com
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D384F51-A97E-11EE-B5B4-DED0D00124D2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1852 iexplore.exe 1852 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2476 1852 iexplore.exe 17 PID 1852 wrote to memory of 2476 1852 iexplore.exe 17 PID 1852 wrote to memory of 2476 1852 iexplore.exe 17 PID 1852 wrote to memory of 2476 1852 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://sedoparking.com/frmpark/atlantichealth.com/skenzor7/park.js?reg_logo=netsol-logo.png®_href_text=This+Page+Is+Under+Construction+-+Coming+Soon!®_href_url=®_href_text_2=Why+am+I+seeing+this+'Under+Construction'+page?®_href_url_2=http://atlantichealth.com/__media__/design/underconstructionnotice.php?d=atlantichealth.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:22⤵PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5946043a2214b81fd2db1f5c8a25bc942
SHA144d4cd51fc21d1f4f6b985275a97c97b381bb9b7
SHA256cca5150e95db73e64eeb614caf3aa15b8d3b664498c53017b16914bfa3c83079
SHA512585c1ceb87a78cb5114e687e2cc443970c180f19048875d1408d86d0af3a6b6b5aa404fb4ea26ce7e3ad42074b006f6e574b27603dc9dfbf394b07275096ad65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbe02bae4d85c805a37ba40be582c311
SHA180aef6cabc4362a7d87d7b8f6fe0a30e567ca454
SHA2568221e959d9fad92bd6f7befa894b283a321d327b102fc50ab19598e4d231bfe9
SHA512c8607f1c0998e957e6eabcfd9b2d2020083e0e4cc6d8835ebe5e1a393278662d43f0b55ad85a0043e2d7da8729951a525ff574203c4ba4efead4ee46924c0698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6fa3ecf79d208306dc94a6bcfd5dbfb
SHA131f0eaae8c969ad10d788bc65cdd63e0f5769083
SHA2561bf16797cd608ecf28a9602ee8030d95b49e86a31e57484776b343216acf28f4
SHA51297b43b3451c928247c4ca641bf7324f9ef0e797a8e72cb2d60fd2ef10ed1c6f5bce767906c19e0f6b261897cc868764964dc2bcd59b83a48140d47d1b73967e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58efa87835e5d0ddcae511646bdbc354e
SHA161f10fc37b051d8344cb4cdce85a8bfdc9236b5c
SHA256d1f771a3cf50930956d63c30f363bc1837b0599fa08d85c6f8f4db57e8666358
SHA512f626e26049bda3edbdfc015fa7cd5c6b377ca9ca4919e1bb10c5aa2deb4592647d49917ccda564e1c4b38acd4aef9247020e69f1b1dc6ab1bd84f12f28b9378e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596be19b7d89fa8205b4891dcb789fd8f
SHA1653909e0317780e65767595f1a183fd66ea3793c
SHA256e9d4c1c4b2bc88f6303a3b4a38c6551188def03f33d7be8233099555f70e4fc1
SHA512e4d85cff74d915e97541ddd0180010345d0475c345b6bbd7c87e815e3b73fa23d6ffb0382b805ddc252f5c51cf61f086a70d3165629f7328bad96864fb955918
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6742009f00f954f4b78d6f3b1e90c47
SHA1b873f1833e24295ba2adef245766dcf7d63cb46f
SHA25669b1e1d3fc01ee318aebec1f981a6b250d69e37a2cc5e193c52da96fc707fe5a
SHA512f7a58ededf38f977edbe7eae90f54a9010c319db5e96b958d3fdeef6a331cdb893bf78266a0cd96976d8751e766af875f422498b227364526e4171d5d3f33a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540340f95465d8f3f91daf4d20b4e0271
SHA1bb48eaacb92d177525d8cda6481f5c780454850d
SHA256e6e80103f71f089106504898096d0f1a6d5d3242bff45591268b884606d40090
SHA5127eb85cbaebdc6abc7eeb5b1f313733e10d6061b2bb9e8a6913f3e7252cf7d8738ac242401d6b2caa651c70f252c29f34054816ba0561979f41301f4e29575fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553b5af700685dc2cee3caa355188e39a
SHA1de3ffbfbad32ba5a73766b579a1b656a48f03ccd
SHA256f3980fbd2db599ae042ae4a221a9f067c5d2c7a6bca878112e347c211bf62fdf
SHA5121f0df298c060080d3103735043c628dfa2bc5d66a3ef1fd922a0d25660c5c9bb1a00c40fef7d66fc25fbec1f5781455944510782fdc0a828fe0b946ec3cf0ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffc47d209c957689e6dbfe58ecbb9bd0
SHA1a642ad3be25020660041d73cc75fd365a5056612
SHA256a0b091f1ffe905b3e30b3950d6effc4071c421ce47ea20e4b2a3099dba55f137
SHA512667527e8e96e048076a2c271735c8500fd3e1a4e22797bb7a74a9a7a811871cfce26b3c882acf0904880d396b11277b442a5c8469ec04941e46a2acf2ad981e4