Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 05:17
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://global-secure-platform-lkg8g.ampfibian.co.nz/ml/?domain=cityswitch.net.au&email=jack.blackwell%40melbourne.vic.gov.au
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://global-secure-platform-lkg8g.ampfibian.co.nz/ml/?domain=cityswitch.net.au&email=jack.blackwell%40melbourne.vic.gov.au
Resource
win10v2004-20231222-en
General
-
Target
https://global-secure-platform-lkg8g.ampfibian.co.nz/ml/?domain=cityswitch.net.au&email=jack.blackwell%40melbourne.vic.gov.au
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000e3f11b8123a46a71141db27e05d666ac907410b1b4959553c395bbe0e7417e57000000000e8000000002000020000000cb7988870db050a3e7978b1607a4156138ae9347b9a47b644c86f4842a3e6f8290000000b9f24b2f3ac1587349c381bd579ba50f22655d820782da4e99e6eea6c57712b41d4bbf5ce38f9e2f6e1eb070cc146ebeb30b3e6d89e15d1d1205cbe19e4450566ab26d879146a1d6a82ea30019c561ab8a2383f9713b9073a84c7d37fe0ac7ed8f63a28abd866381298c79e1065677e5df8085b3f9b076f256d1f508e084a8af3bd4054eb73d30e5df2a12b7d55c080e40000000195aeda3e702ab90735066c1cde8567c47c6fb2169b178b114d72f3e88ce26e2364cb519156283136fdfe7aa55810731f5f9e5d17986b2cf4e2e5c11bcaa9458 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E3ED241-ADE5-11EE-8575-62DD1C0ECF51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0635b28f241da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f8d467238646bd441762afd6a4d30d029eccecf7c39aa65946c7257984eed4e6000000000e80000000020000200000006716e53cd0b7d5a69cb9af96d98fc7617d6b87a9f1cbd9dcfa3cf7c2c0d8442320000000126ec628bf5cc7ad9d1165f12bc9d8afcdd74edcec5e5c31ad940dbf8bf5d9e0400000000c49b1e5342e80e9636cfb23ff3760a85c3826c52386dcc9ba2519af2db1d7e4ed59c5c6b86f44d506aeca3505cc6b10ffb61b2d68820fe5729246e77644c2cc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410852961" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2140 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2140 iexplore.exe 2140 iexplore.exe 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE 2844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2844 2140 iexplore.exe 28 PID 2140 wrote to memory of 2844 2140 iexplore.exe 28 PID 2140 wrote to memory of 2844 2140 iexplore.exe 28 PID 2140 wrote to memory of 2844 2140 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://global-secure-platform-lkg8g.ampfibian.co.nz/ml/?domain=cityswitch.net.au&email=jack.blackwell%40melbourne.vic.gov.au1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5123520047135e6e4c38f0b2e2fdfce6d
SHA1d2f0f54ce9511772c6ff16b38d219c69ea31ce9c
SHA256cf38a0a2deafd7ffc2ca8b298edaeef044c35ed66f10a7b6781009b4fbdf8694
SHA512e9f94c324797f42b72c2f4fa7579fd8b978016a6a3f96d96a2047ca56838fff597d9582d1e8550e304d045f25e007abf60ee01f509ae6bbe6d9dd599aa3696b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525e52359440ccd22a23dcae3ce973248
SHA1ec0db50e57490a86d53eb8226265b95b5a98c53e
SHA25635d34c47b16db6fa74179e79195f4213758420e814c5282cec5e3c5d26be51dd
SHA512c5fd4af1ebe990e71cfa661248de925bb91cb944f0b3072a4e5539cfa4d7c0e3ac1ce79fc487672727e71fca9b4a8e79840d192dc93cd2502bb657d7329ba2ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e351424cf7c0cdb89ea15d4377153cd6
SHA1771862c37fcfc9fbdd3e624c24e883e594d13161
SHA256be7704e14aec5a25de67ae72d8819600ac26f507a2c20a0d3bedcddf7e096fda
SHA5129998fb94bdf88a9a576c0e3f6c099a4296373a3725b24a326f5246f61e0a32a1bb682443e3d8ebf87180424fcc6a629a1d71da4e815ed2748ff93ee73ce98620
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4f12f8e676cc47d1af5b0764401f593
SHA13234d434939a5da70bda90f78056fd6ed56ff829
SHA256d820c45507eba35828c5c50c392fb0c824eba31486e7be449959509f29314bf7
SHA512e871fcae66cf63bfcbd20f36689df32f6f735fbd8437630a69f5764238d445c0ab2570d4a7cc5b2d97b56ce93808d9c1b29f32fa509751625e8914637f5beef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cd6bb3b47a3893f93ddb93d859e5bfe
SHA1a4a10af6f22d1e3acbad5dde0c28921abd750249
SHA2561b63d2ba4f8e7a2e717063377b181790632268f2a6063f3091e9514eb7068807
SHA512240fd379459c2c4e6bdb1be2414a56d3b428a1a32ecb181ca5cbf4e9d991c6e32a4bae0aa07aee5b3babac4b7e1b23a4ba61139e193b76b76ccba199ca0a2ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4fa36e16d512916c5d685194b229f0f
SHA1c563f1dfff5383580cc797468f24dd2fcd8f81df
SHA256381d0d0b517a47b3432af18232ab88c2d1e6fe03c3f67f2a998a8f914c4150b5
SHA512dac2c5e18488d3b5af0e249538820b6547bad82c1abe269ed165e5ac77f33e9a386e52a5488534dab843278fbf1947132121fc735304fe5764cbdb52336ea89a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5364914cbc26c97f9caeb80643b7e46f9
SHA15534595ed4552b7a38d563859c1df77084beb8ae
SHA2567a0a9091f740cc31185a101ec2f5d13a60628f86f6d2d2eef306dea7200cb7a6
SHA5120cb7280722c6a5fecf233f281377fc37bca24f87132834c73a45c7e409095321ea3dc1d40be5c3f0c4a039c801d742fd075bb93d9406cc27a9e14a6ea138a20e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d88c6dd7ea6f1235669affe68f06bf58
SHA1d7b1548ad69fc2da00cb0e7f6b7aac472691bffe
SHA256a5bd259949924d27d582154bf63cbde8a5065871259df6006a85e158f832fd31
SHA512e2fc5b16a35761a2bbd303651f46ae200f4430c0dfd7fb281a9292e873addae6c1079ec38545eceeb15fa5ae402aa027c5b9e77a50ddd5256f3228b531ec6471
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06