Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 09:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://concsoweb-prd.cisco.com
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://concsoweb-prd.cisco.com
Resource
win10v2004-20231222-en
General
-
Target
http://concsoweb-prd.cisco.com
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410868516" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90602d761642da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c965e4158a405d82380f9abdd8f7fd3713e20fbc125b9b397dde8638453dc015000000000e8000000002000020000000c83eb4992e37cc18ed99faa1973f408bdeb36301d77bc9dad294c3e2fb6ff11b20000000b93874ec917b9c8c5a9bda4da58c632496659441e5f2159530a0e213d7c7d48c40000000b39fdfb1d49137b66f70e3ec4299bb25971d0767be5e1bb0a90552da597a85d6bc00c092ca66513173af11cdd05de4d6543e45219f31909f854ea7e9e4748be1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000abb7f68fafcef87aec67502332a4d4862553c33e6ec06350204d1efa7f91b557000000000e800000000200002000000069c8ea485b32e5c7324f713de4227d566cc3ea7e042bbce6bf6bb42ac6a6ad83900000005fe815eac769d8de488691a6506a2ba0870cf7b84855a7c41bd701e1d6a7ab6d6b853e397961162b2e55744e248616e828783742462d63717422bc36b8f37cdbceaa8264ac8056e5724e3fbfe0070d127bc6b2601e0cb0f538392f1fe3733320711f352fb44847a4e5e6cac7644ab7bdd64095495b071916652e9a32b751e6173e1638efed1ae5eed9278a30c1a1671640000000e7c4b5e9b0daa201d6a75c423ae724daa756b1a94fc24f888ff614091a449a99d44a3f3f7fbe32234c9a94a2c790d2246084f88073bc2f2af59461f5fd02307f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{87FA8141-AE09-11EE-A623-CE9B5D0C5DE4} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2532 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2532 iexplore.exe 2532 iexplore.exe 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE 2308 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2308 2532 iexplore.exe 28 PID 2532 wrote to memory of 2308 2532 iexplore.exe 28 PID 2532 wrote to memory of 2308 2532 iexplore.exe 28 PID 2532 wrote to memory of 2308 2532 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://concsoweb-prd.cisco.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e99e2b01a22f01bb11e8b612ba933904
SHA1044ef29af0e68e4427455074f54fcf65762e49e0
SHA2564b105d74aff5e378603d5c9d4b12e0b96eba13fa3ecd63b9602d0de0c9e760d0
SHA512e92946170112865c3eab3af850a02b174d08ebea2f34dae629673468653c775c7924f1bfb0419ce7931085f34fa54adb66fd85d76eaa2554bbad354e871095b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581257fb4c81934ec64bf61dc1c7efe8a
SHA150a001b4fe1b6d2019c5e538146b26979f956157
SHA256354a2f9e11e70c53e71fbccf46480aeaf07b9f15175d2a552deffd0582786e74
SHA51247e930822bf3a957ff1a7cdee0500cafe30a3fd05325f7bb609a3b1bfdb4ea81ab3e6a31e3fdaec182689ddca63d7c99857933644167293522304f8ff18a6b63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f16e1776bbb49c8f0902e98fadb1b751
SHA1a1cfa780bc83af282fa675cc9f377fbfdb29a6bd
SHA25691f97e9a47640f088b3ef9e846d1ec5f460801e12a28d400d89b24bd757d09f1
SHA5127d703af8b932e1be9a3bed85187047750100d097fa9238ecf75708d3c2868652bcd0e946a6301fc506df9456f8debf8982fc321b3197db22002b02c0ca5c7ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57768c39c44cd87f0cdb47cc75b066972
SHA1f03444b14135c96ef3a75cfc94638db9b2076554
SHA2562cc5b986eee957856b733daf7091a1216f9dcaad6d9edf1ef68c04f05990cdca
SHA512a083bd57540b7b4fcd81c7ad6fa862853d51143fa8c5b6ddeffac268a675ef19a720976b494ac4802899bad4aa712b2b35254400f23d56586f57ee8bb38f0cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59116494d0c200708156e0cf29d9a0b09
SHA1792458178bf2cdcf6d11e4546c5270dd9e8118a6
SHA256b9c71714d51b208dff95ba85ac03c534806d2a6eca979df51e2ddf736f0d000d
SHA512299840f72831526de321f9833abddb21d03e6dd0e8fa850b627c3f49e955439fed0a99ff9bd602dc83412468a6ac91086faa9cc02a3b8ab2937e741c6482ce98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd451fe6f5cc6d7d792f25e6b5eb058e
SHA1feef9fe0aeb5b712c6218c2cdc208e5c010713a1
SHA256aa46b9fc4cba96d9daf48d0f169c5c01f5a7ec8db2ced050715fef1e7eafb71e
SHA512ced71cb6be2b9784d3885f719fcebef6e0ae9ca7202c58869780f204351f09ec2a5c3955eecd0325cd60675ae58c48898070e7eb64805d167ac7e1bfd8de5a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527b91d505a9526cff0358969b088712f
SHA14cc53466097b639c44d8ef925e4e2ec4496c3bba
SHA2566d96c4baf39fbad03604f045e8cb26aab6a06c5a945290766e7071193519fa0b
SHA512dda425b988bf8e7bc486a5b92bb794aeb4cfdf68db433d87bd6ea448667f5e97fe23aa0f55ed8a8a55b054215033806dc42eacf8a4eca8f193a3478da5079e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddaff734c1d4f55754402c2c68680152
SHA15a003283d5034d63bfb44c2359fcffdbb612aad4
SHA256853d2b413a820c9582eb7aa68b359f3005d3dcf5e5b1525842d07244fb290ed8
SHA512035029e34a2df632133bfa2cda68f774f9c0e4987b4170b0158164f9355d8d0f7e375000ba45fcbaca35c388ad9d6b08e2308e417f8de5f316f5919ab2674fd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9c962381cac94ae842a6e77b8b43861
SHA11e6542a5c3e6bccac3d787757328b349227f311a
SHA256cc9a364aa829ce45967089d95d02d3b1983444c22084afaa084dd419481560c7
SHA512b0be3a1837ebc3618bdd7532d2c55db077c087d9ad484c5c7b9ffe07c6aa6f12b295ae1970e56dd14cd785689449e16fcb3318568ab4f81bd9957a197e6e87f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c7333d5d9369249541ddd279b844a66
SHA1058178513fbf36f07cba0505bca12afadfa7340d
SHA256ce377989b57e32c5bd52e288698d2212b06423444c69f4a460141384685477b3
SHA512771eb4912b11e7f57478e667e400de2df55551736d568c30fed8b000c693ea53414ccd878c177725ef20531b8c51d24850d74ab6ddf2c927a7496be95f802e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b762b988ff8d88532079cc4115d5c0d2
SHA1ec059444a0a236475e66de4f971ba50984aac3d0
SHA256ba1a2332dbdeeb78380047e778b7af80200c64edace9eeed636340f9dfc5287a
SHA5120d2f53915e2cdd92615b0322700e66039bfe93ae8243c185e131fe7b893820e3329b45044d7a1e65dbf0a658692e056bfc1da1d207a273cef8b690ada71eda5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0599c8c787679551428c84516d8f895
SHA1c6c14acd58bbd8f8a03602abb5c87eefbbb18bd3
SHA2563d022b140305d70002bd658b2e770e7579c3b3a030fa76e1441c91a51230e591
SHA5121474dd5456359763edf5004b6066bc786ee6b774197c28a97f3f0d71788d80d134e24a6f4ca29e6c5a7c4b17b98800f0061f8dacccf12716581e312c02519445
-
Filesize
22KB
MD59a200c0d8aa9a7e7619a31670d871515
SHA1a0316178768d8e04f12ab4976de7fd5289fec818
SHA256fbd7321115fb7fbc361be25209a858149b9272287ee517f21efb864b6ca4f741
SHA512fded6aaba0bd6e53f250a3975f5f1188b18b3e7196ffcccd5675eb435ff7482ed90fa423e693b47afb186fd0673f3a39b1d3f6eee57205199495f59d89bcf8e4
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06