Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 16:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dl.google.com/tag/s/appguid=%7b8a69d345-d564-463c-aff1-a69d9e530f96%7d&iid=%7b89452841-ba15-556f-1798-31dea9c06ea4%7d&lang=en&browser=5&usagestats=0&appname=google%20chrome&needsadmin=true&ap=x64-stable-statsdef_0&brand=gcea/dl/chrome/install/googlechromestandaloneenterprise64.msi'
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://dl.google.com/tag/s/appguid=%7b8a69d345-d564-463c-aff1-a69d9e530f96%7d&iid=%7b89452841-ba15-556f-1798-31dea9c06ea4%7d&lang=en&browser=5&usagestats=0&appname=google%20chrome&needsadmin=true&ap=x64-stable-statsdef_0&brand=gcea/dl/chrome/install/googlechromestandaloneenterprise64.msi'
Resource
win10v2004-20231215-en
General
-
Target
https://dl.google.com/tag/s/appguid=%7b8a69d345-d564-463c-aff1-a69d9e530f96%7d&iid=%7b89452841-ba15-556f-1798-31dea9c06ea4%7d&lang=en&browser=5&usagestats=0&appname=google%20chrome&needsadmin=true&ap=x64-stable-statsdef_0&brand=gcea/dl/chrome/install/googlechromestandaloneenterprise64.msi'
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000cb9f5ae1a697a06f240abb42bf412031882df9bbba307e95da885214637d6880000000000e800000000200002000000063fee4b0da6c639483d46ccc7ea41f4ceca3f853882c0259f1b9f4fa2f6c3b8c20000000cafa288c385a169d7af8e3238eac141c28c07936cd99e4dee5d2908b0c11c49840000000a6b0a257c72da5a8b14c17c668c2d0b058aaf4cf277173408c32bf6857b19115cf22cb8df1a2e3983151a92d3e4000ec83667f4d3de9a0f31d1fc2acdf061d59 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E87D0901-B61C-11EE-B58D-6A1079A24C90} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f73a9104dc68e2cfdd478c2232c8ac3c08773a230f739af34166ff6299601b5f000000000e800000000200002000000031e2c53eb23a472c43ce6b1f40c8c115d2b83e43f45d5c31a2db529c50ad98af90000000fd189d4124a05873b311b362caf500e9e76c92aa5818c430293a4687aada72582bdcaa67cac96171c649b73c26530286af5fcffd73b648129c8d7fa66c9648e32c8fbc87aab808bcce39a1b2b3a96d5f30f23964e0c80fb8ec85695e7e71ce04d036839bbc626c28738dc7e59d7e5f4c1ef7dc47e2130b2d55a3ef30b60ba65277cdcbe6ce6fa591c159e24391d6938740000000de8586de867713527042f27ce5f14080d5f8708e8708e0b66c962f58aafc2af2c9ea8a83ccc8bfc18b685aa4fd96dba6c2557a185c3b108c564700acc0a9c173 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03928bf294ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411756446" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2148 2184 iexplore.exe 28 PID 2184 wrote to memory of 2148 2184 iexplore.exe 28 PID 2184 wrote to memory of 2148 2184 iexplore.exe 28 PID 2184 wrote to memory of 2148 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://dl.google.com/tag/s/appguid=%7b8a69d345-d564-463c-aff1-a69d9e530f96%7d&iid=%7b89452841-ba15-556f-1798-31dea9c06ea4%7d&lang=en&browser=5&usagestats=0&appname=google%20chrome&needsadmin=true&ap=x64-stable-statsdef_0&brand=gcea/dl/chrome/install/googlechromestandaloneenterprise64.msi'1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD500e717bcf5dff9454078c85d810d8be7
SHA183a8a5d9655ce6129a175c3c06a1b644dda609e4
SHA2566cd5b7a63eb65baf9fb00ffa5ae23423cbee0caf16a55ff85d38dbbf34913325
SHA512f170a1a7114ad06b428d3142ff782df8a5aa2ad8cfc8289a5d391187849f833238c6c46fdcbc4570a9bf4e79c109a4dc8d8ce45554abf56f61ffef9f74bf6a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de949fb0de2820bc94133f2d3f899040
SHA17df07f99f3daa52adc2cc369084ed4e76695eaef
SHA2568244165b4d60f6a075d5445b15418ff1b9e3d13ba4766310db01b8c106822498
SHA512b64f3371987a88af9b93d4d1f9b659c81a9f301dc6a16d4bc52c93f5cebcef074e7de989024749440d573f74e9cba8afd7221388d6429382c27975d5185ded19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569b42ee72bf9441cb36fa82c8cbdcb8f
SHA1ce5e4c7c49594fe29db320fb97ee9e03471f38cc
SHA256d42c79a5b81d98f17c3206110ea84a6bce40e462a9131da7014ca0de1559f939
SHA5129c2e4fe449fa8ee2a428cf16d93e9e5aa55d2b2a1ae3564516ff466f86e297dccd459813b05ef09ceb4790723b733217d616d4a4db0d9eeec613e614978ca72c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0b6204375e6580093991f5863b6f669
SHA1854f57c0d96c4361c117d320758ef70bfddcb550
SHA25694a6f64787574a8c6972b8679a66674b8dbed94b2e99bcf9b29c41b1d6a1ff36
SHA512f015b1ccd755691579fd70e2cfc45edb198677474813b03c116f513a72f50f44b94d27adfd34afc926cf52874eb92344819db5dd57bc711a481545cf8ec1339b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6736ef927bd74ccf0b850c5426c4263
SHA1bd3b7ee87ef6428499ddff93283b6eb9ba2d2b08
SHA256c5818f2c6bf15003dedef4c46628d295421fa8b5e4de12632474526d9f40522e
SHA51292fdfedaad8925e53e6865195e35e6cced82a26c3dda3ecb4accf78d541acfad35e07e7f7f34022b1cbce1d4f67f102475e75b9bcdae5d111679082d311ed286
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593db900ab6f1f64fcae67e8ac9d656e5
SHA1deca963d735a7e8b85caebb84225c31ff2751cbe
SHA256217a1ab00ab54c070530a84b9f0eaec4988f10cfd80d8cd9b9e32291c6ec5134
SHA512abda08f7e750944bccdbbeaeeb4735e4f274728d2700173fb44211c7e34bdc78b18857f6ee9a0b64538228cab19c46dfc7ed4230d3afb37cc97359ebccf6fde3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d48d8320d4dfaa862fd1befa4f1933f2
SHA1bb99855b3d4fc3d4c6e56ce0e291b45dbe57bf3a
SHA25627ea36978a6232667e2b07e44f6616302097f86754afb9852eafad358b3c8a60
SHA512d4e4285be8b8d8202176448f5aa721c00bae244fbf15e5dd4bda362bdfff4e32a0d82311389234bcfea1cda430225ba427bfcd828bbd8e81c3dedde86ec86648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5037be71bfe2bf26e03991521cd6e9a37
SHA19bed4a5265244c38f64872b47c8f01897c87cfca
SHA2565f7beeab32771dcea752ccfcc54e0f00984f110a8289ed74522f08e76517ff66
SHA5128263a9ab740778e470f90108ab04d43201f3f2d0a4e4cdda7b94aa4de13ba21f6cf59f0e8d71d3cc112912190fc18760454f48d86b549e6d6776935edfc3d03d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc70c43f77c745f72f5afe2c58eae665
SHA15ff5cef6f642d7b741ccdadd438f7e5caa553efb
SHA2565ac2264243eae3ed32d89ec0fcea133406a414a09cc429c12a891a46d5b2980c
SHA512676180e73666ee8fe110d53f5243768c30f541ed34882df9839a1a60607c5cb6731cc9c7f8b73036994361e7726f4b16f2588bdf5b04cc6391ad212ad2b907a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599637e33027ec623d8070d4a127c4d57
SHA122e8325bd2c5db16c0bd247b69884d3f449338b7
SHA25648de110cbd1ff8de19063c4cbfccd190314e772073677a3ec1e6bd6a6cb565b6
SHA5120291763661e085f421dda9cd31303cfe41be7f19338b480072637a92ed4c3f069bc4ee73a8e9963ed0e9a6ca3688fabad28daaba83c9db41519c3c7fda39dd77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c36f47b1113667ad4c85d7ff0618959
SHA13e3ffbb2c43d9fb3e90d9cb169a82b108de0d287
SHA2560bb14e5efc1345145443058e5e3cdcf126a12de8457f7d4971de0d15cead4d23
SHA5128438ea7a070f1f1a01d4c9b1b59e96ee82bfb56d3097d0e1cdea279320a4e15e23dfd91d5b4e2e996789d3703c8e77548d98ebe2eb7b84ee07a6c14dc5ebc1d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD587a02bdc1643d34ee472861700f3e990
SHA11ceab90f29cdfe5d96b17ff089054dd6682d1443
SHA25648a537a0edddc7787146a99b3ae1ccacb43773d55dd4fafbd69f7a395eaa6b2d
SHA5121a1f1c833ff1572054b1e7451bc4abe34ffe7f5b53897d6396623ac9d530dd80dda28e2d42ceee3fb3a9e56f4345d698dfc11c6c6fc87ee7e825b6bd11fd22a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5eae8ca94a935bf97293232c45f358cfe
SHA1aa57347a9d37d2890ad8971df9e90012e1fc8773
SHA256384da0d0fde5baeb142924f1934563f51d984ebdfa2b096703434db6465743c2
SHA51242ff9845a6addcec6b9eb0d56d28dd41fe652ff6b838bbbe6f19bf53d1804747b5fd495a34bea7cf98621b6496f97ac641a9c48fe3be67ae4791b4fcdc4a2fe6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06