Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
04/01/2024, 19:12
240104-xw1qpahccp 10Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 19:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://youremailonline.com
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://youremailonline.com
Resource
win10v2004-20231215-en
General
-
Target
http://youremailonline.com
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0352d2d423fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53D0FE71-AB35-11EE-AE81-EAAD54D9E991} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004384565b32e2e4fb427420c96d8b52705df08df853ae2245e9d9ca98cf56c36d000000000e800000000200002000000035b5898e8d06004cf51da02850c396a7fa83e26319f8a38e9d7393c566279d8e9000000009533bf318c63e35db098d1d362cfd693d00e5c06bb6628fdd97ee0f83241f365c6e4b4f902fea03ea37e9551094542ab6c9d5e3ef5a63448464e48fb0e559a6996ec59f78f311f1290d21525837b6d7df0405d6dd1eef4ea010422b7437f5fd9d6d1b42d72ce66572b2f66a1496ff1b627c62a07dea583b30757bfd3d0dc8deb800ff33ec433a9e663496f79b833d2c400000005b50728c7bfbee0cd09aa625eb60805ef74839369d3a94b42df460d7bf31b928022504842a394fe0d9d0774203c622f0dd9a59a87488ee6403b21dd751d8fae7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000010ca9ad7db521e9e3f4a17b31514834f5b7026456daf22d84ed864058bb31a00000000000e8000000002000020000000f6a15fb785027d1e4823cb203c1cad2326cbeb7614749c9f0095ab2da3cd07b82000000020056acd49365b317695eaf9f6e1cca3efeddeca06171773ebdfca6397e6a3e64000000022978e61ff773fcb83be770953ad8fdaad0176c3314b61a7ff327cb693f4640182722dbc04b8548734bce6acb891f33955ba96aeea9f2f324e26de6435f08d48 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410557479" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2444 iexplore.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2444 iexplore.exe 2444 iexplore.exe 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE 1344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1344 2444 iexplore.exe 27 PID 2444 wrote to memory of 1344 2444 iexplore.exe 27 PID 2444 wrote to memory of 1344 2444 iexplore.exe 27 PID 2444 wrote to memory of 1344 2444 iexplore.exe 27
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://youremailonline.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a7d99e186fc5f844bfe05e4b6725ff0
SHA11598c9849397691a2c6b54441eda30f4dcdbad94
SHA256a5c408faf3b7b8182a29aab96bb5ed56e42efe08fe5a335af582f96dd5ab1388
SHA512eb2f0c0391aa5eeebb82909a82d5f8a49b0b015de2b65b7c0edc26cb708589e44f183e68b3fe232359ab6dae54fc608c5439c356ec9678dde67e487ea4cb72d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba923a4ad5f707baf9b0f006a78acb6f
SHA1a6732cb20bd7b61ecfbabcdd801cc31e678c1513
SHA256481c655e3865c862ebf064ef303535a8b04bcc9b45fa909a4afb877c5b26c292
SHA5123fc7b8805b290ca5977f6e9de2541682a7f54ce8e75860175fe1bc69729894dc84699a613e47b0cf7b977f6dad17cd97c4db784a62584e574d1abe9bb2ff1b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5341a74af23acbef130165886a7008f9f
SHA12a58679cb60b7b4e7b3fc63650ac103ece3a8f55
SHA256c92f9cb48823cb99263dc2d0c5769272af64258d10d9de3c00e3a7699b7d838b
SHA512ea2b7808395365d64c0e0032cb0528076db1ef19c13b00ecae508a3469f96c0ef362bab383eeaca7c9db8028579bc32b393f9f9c0c08c07244cb9963bf563ac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58613bd1a63bdb66aef207574888950cd
SHA1c45637888798619ee2df7a77638fa1db82814d78
SHA256da7ec8124b800ca816ed5fc79b2a358ed60e161c5ca29cf1ae43721197c405c1
SHA5122fa9cb0b344070626562c5c8ecd76fa96f5dcd6e3bc3f90e923ac037938f277577ca517fe4f2ba40dba44e826013bf91c871d49af19988da09b8c545445b9d10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506fc4351049ad0b6240b5bb3c4018190
SHA1ef8d87a8aef584dc92b9d6f73c44842d21e68a71
SHA25682d47cb4ff446b51164a14a445e326a9dd0df1f9eecccaf15928eb164f76eaca
SHA512d61a8d08d201b7653bb895e145df4776756577f43eac255f636862b4381cefb4dbc6abbb8c2bd736145a11acab60f81c529a310f0732f1ec5f06f3a198a78284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ba3b18f222fd07ab587ccd0474f4f7c
SHA1cceac54283a3e3c98aeac29f5f8bb359ecc6c965
SHA25692c30860e0f41930f38641e6a888586b227d67f1af7c7e3333c922c1e56d7087
SHA51266f41145b42e7421c60a8828962c277604ea9d1e2389d2e1e16103f6c5a7970df734cb1d49dca124e1b7644db294fcd241f7542d6f8236921120cdc973933b41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9bbcbdb8f0346503d57e68780bb0c82
SHA1972d333f6e8029b3124157292885306bf5ebc5e3
SHA256e0d06b1a3e132b64fb91f0acedf9f442e46781bfdc10780ea1341b8c4424c853
SHA5123e7e7e9de7d541892e100c7a81a8679a7b354837a4b0c22dd8f199c126ce4a22455c0ff422e428621b1ae2aafd17c9216f8c06f75198d5ed1be75e5c577faf75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589db69a8dff38946668de4d065cac58e
SHA159882d56569f07b4824d85565cf50dcc8c717ee6
SHA25616f2a4f98d268a9ceeb6cd7bb3038812381424bda4cc9034aeb06217f1e7e46f
SHA512ca1890e949cd5d79398a893f0f86ccafb64f2afa223c52e5a464d1ad9c2507f7afc4ae51840adf9ad51205c84d2ad0d2df333c5cd1c93ec712fb1fa391831b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe8560a8b42b46a4c8c45c69ad9169d2
SHA1de0a8658fc8765633de7665638323f2161400036
SHA256d62e34c0220bd654c28ed7c10df053a7e81c3284103332d1c1cbb60328a65049
SHA5128326f2f6f5a85b6a0562b9612ddd704013aa45efa2898bf1777bd84631a165c7f988a26ee3b60c88f803bd729732ece5fe77b52158f4f38a9c34877b06b93a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55602ff8d3604278f0d8021d165dd751f
SHA11c669c3e6a577a8889405ad9cc80776c7f094b9f
SHA256494983917ba740d4d56709942efb008b78bd4c5bad154d87b2536161f7ed804b
SHA51235c0e2b8935c3ce662a76da10ac5dff2fcb2832dd889d44820c9526002e3ec20d10db8cab28a6b9379354f0bc72365f003cdb833f465d228a4c5c858bd024f6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b3df68967071430d189ae4a50416c3f
SHA14d5d80ccb03b81e77e0f394a40defd666d4860f1
SHA256e8a428d8fea92078aeffdf0db34f3201339de326e2c31d6b2276d1542f70993b
SHA512af3327ee0c0c86aed017f3d8767ccd5bdac994de353f8bc2743e8d076fe313f7693f6d6f442d6c4b1bfaecf03a024f553fd0f8b577d0170ad799543ec689da68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519b14e976a202c72b845ba55a820c8d4
SHA1f5a50ae553c990b8749aaaa9b823783a134c42b0
SHA25669b01b77bb535dcbc40bbf81e693e532b69f17dbb9ed88427a98aeb49f03fc4e
SHA512ab7e74abe8923763e82f1eb472049328f114e648f247b14b8cd6c56bd7b2b9f05b0cf5bfce3f58633a3c52e2fc4c3144365656e2db64ac176783643969b678a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e11ee0d8c515485b38c95e5b494283e8
SHA122eae115c0f4903e4cedbda64923acbeac32895b
SHA256e38c6393580a5cc3aa508e0061f57580d52dd712b8ce9c8ba24b3788152408f3
SHA5120ab7a4b5f5f8e1aab148d31fc40391cecb0ac8598db49992b6926b5794ba5d2158d8828c8f3fb9c3a5070cd8658ee05e013cb2fd29e88032245b1e7ec3e372d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ee4ffd58c36e243cfbe9c09166d5fb3
SHA19431cb2e54d2a902a8686fbc0deb6eef8aba55ed
SHA2563901e3609570663ce98e1b04e1ceae8a48e1bd16cf472403eacef4b651d56c73
SHA512411c7d877680ffee2da675e6d224642b0db6d70faefa4d159c8acf488075dd42f69269e7d4d22d3e5338b5e2155332caca43c636b1b1a78792049817490f7f1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54681333a6ab43a1df4278fae82035d86
SHA1586ad36c80a7c1e3544b43f2b656b904dfd88b41
SHA2568ea7fc1244df083e453621c0382e131eaa4c5cb55f561bba6b2106d5c07ddb0b
SHA5126ff616c8ee94125271b2b99044e52d964eb155884ae5beb6b73d01b89e2b1143ccdf263b8120fc57e3a5f7689b1c48ae6033cc869b93d6e71ec11b75ee5910d5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06