Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
14/01/2024, 05:14
240114-fw642adfc6 1Analysis
-
max time kernel
119s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/01/2024, 05:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://netcdn.xyz/app/406889139/100-free-spins-coin-master-game-hack
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://netcdn.xyz/app/406889139/100-free-spins-coin-master-game-hack
Resource
win10v2004-20231215-en
General
-
Target
https://netcdn.xyz/app/406889139/100-free-spins-coin-master-game-hack
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000872e08309110c1a94cbaec7cfaba450ae24635863971b9e7a278dc7369328014000000000e8000000002000020000000b9b836d86a03bd88e4fcfbc635b861255876ca7a0a4006ebc08cb8c01fc6d8bc2000000089edfb2c6430de2de103618640bace5f2e9e0f3e456bba65daf2b76ab4f69fc5400000003af91a44bfbec18c678048d00be65e7bac6540bd9b71f1d34f109f12e5f6d975ac5b219dbd252899852c583a56a492debb3bce8e96fe7f52f7a1e7d7069532e8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411371160" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5F11E41-B29B-11EE-9240-46FAA8558A22} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d090f4aca846da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000124980e2e062850e47c17039166a4b77bbddb882c978aabde7c4e9065db15812000000000e800000000200002000000042a05995dcea0fad1cb168036a726b7b5d4cdd4b674637a7794072f07804b778900000004a772797917d622c598dc65b54efb46e55e6829fbfdeb3534bbc440ca68922189235b9305174dcf3faaf1b01fe4313cc54862e5359c8afd36f5a66b6c10fde86e73fcad205613eae36fef04ede6175069f001cfaa89803a878b927ccf777d4db3604a3529c7191e397150ab2b9f55e12a9aea161a0a91a5df8adf76e416429863103d5187f29de1cd34780e4e84510bb400000005994f312eed1c1a618c2a34a3f76caf9735a6a6a5bf2f215c44d86e1512e98487ec0829edf1f6e5a40eb75fb232ae9d3531992a2a27afaf71c150cb9dd1523c8 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2436 iexplore.exe 2436 iexplore.exe 1540 IEXPLORE.EXE 1540 IEXPLORE.EXE 1540 IEXPLORE.EXE 1540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1540 2436 iexplore.exe 28 PID 2436 wrote to memory of 1540 2436 iexplore.exe 28 PID 2436 wrote to memory of 1540 2436 iexplore.exe 28 PID 2436 wrote to memory of 1540 2436 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://netcdn.xyz/app/406889139/100-free-spins-coin-master-game-hack1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a5f93f78f0add87c04e98f1e36663b7
SHA1a8861667c3fea6fb5d252c87562a25752a899603
SHA256d3dae3f35ae711aa779283896ecf509ae6c48ef94088f820e98fef121f1907e8
SHA512ef00ddc31e07f7a38f2ac1e4f799b3383df2bb42677784bba9e8fa1a101959c91fafdb953dc3d4f7ecd9e842aafbdd687ef95d0e5612646631c59f1c7a94acc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5550b744d13867b90f412cba19090ff0c
SHA1f250d6cd410a586a752d553ba743ac91fee41ab6
SHA256ae0eb5808a5038df03763acbcb661c7e5ad9fa3e3450da4708a498a8507f5b17
SHA512882ee12bf168bda4e56dbce13f708ca167777ab74eb2e37c907424cb076e4b97f82065bf2c44e9fa27f446573cbaa0d483db9bbd414ff3c1c961f1f7fa1ba5a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e425dee53d29d8ab17fa604cb8e07868
SHA1ad0158edf5103d834398a6a6739e2efd359b1b5b
SHA256d68be2bab79424f8e4b78cc63716a75f8856f11c5ec54409782332c1602ac774
SHA512cd4287495f8d98f74ee123ebed0d4484440838fef01455f3376f2126e8a20f76a1aaa75b90f464144bf582f496d8d60beba8c99bbf9697d29d061a19533221d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e68dfeddf0466695adabaf3e4d031e13
SHA1810cad5706e57e887106a83b3165be839429fddb
SHA256d34098d7081e1f9dd57d03053db3efdcc1979e54b03d9442e6de4c74865da5ac
SHA5126d01ed244a5f1a4bf4435af2b15b81eb5c5282850c989ca915c22eda43e36a6eef4d036e27bc743bb48ec13e7239170ce7eabaf2014d1df4987f036dad1a544a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b5698ff529e158304e14d656daece5f
SHA19bccee399ca72fa44da3c97d854406b5f8d51808
SHA2568f258536982f75225b91fc564e9300381853592f70d65c0e238bdfc1e1f593fd
SHA512ed5cbe61fdde31e2307fc18335fcbda1b0b396475c482fcd897c9b50791badceaf4d4ced137177c71a8ee8ecc0bf2d2a42ab16516c917bd4685b8b4f8f909f0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597536fd3f19afccc0058f87c0edb4de2
SHA1f47f379ced6cd4f8811e409c74c86d43c928e214
SHA2569028a6be7424cd3780ea815af32a548f105866eec46a3b35fe355760fce3516c
SHA512a6b1e88f31740e370802284bda204aa95f455297d074d70b667266cc121dc3a0d74a308aba8257b23e7afd7dbf7823bd90c719fc3bc279a5e5b1289af5944ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51aff925efc23dbdc4e421b476ef1d7e4
SHA1cd6a69d1c58a0db2cf40aef141438f04e366bdde
SHA25660af45f1a9faa8f9818c9768b5d3db9d9b64e19e48681342a671cb5d5ee8cb3a
SHA51224d36814443c87b69133da310066bda33963dd60efb5a86dc39cf055f79764dd0a58608c873c4a35488ba4120a782cba65843c9ea872ec6103156c8db139c409
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8440a48eb67d1ec4c13e5833b1bb657
SHA14392c72468065cc0df994a0c428c153c0e81e4a8
SHA25672b4f5f6cb62a360f765b9a3e352cbb1e8cdee38b0cedafc2c31df5f862e6f86
SHA5124d17a12cac6ca040019a3268a42579956cee91cee3fe87df4ac1644865433fa10393b2a1f1aaf28e230b107ad8a66a2ce41318ab64894ce64b90a7cbf56e78f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e83ebbb20cb7251746a9dd2a9d36155e
SHA13e3452f0aee95f8e6429a369d156802d0d7d0829
SHA2566d93221a26adf49250db3f2e7d26ae243ed7f370ab7a25260a2b88af4cef8d6a
SHA512c057d8304bd5b86ce56c831c21a3f23f9a9d922b298e8d72f7470446ff7fd04d89fdb8f95d497ab07071c36b42753f2e43dba6225745a1d998712367085ac2e4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06