Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
277s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 14:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vjlhg7.za.com/
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://vjlhg7.za.com/
Resource
win10v2004-20231215-en
General
-
Target
https://vjlhg7.za.com/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412181472" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000005ed21f94d50fc4b04bb564bbf547a73edb348e9a0156b71e783899d6c3fe5e76000000000e800000000200002000000036cbf80c27bc90a34f79d81e6e0b4c921737f391faf0aee392580af0f55bfffb200000008da0ad92e3ecf08b9a2178000a43dc0625ed93adef30b19e2e100855135cc14540000000f137e2abcc8a9df67e86d63ed229eafd5f2aa0bb6240c8792dd229553fd04514c8699972bcd73b2c73ae2f3fd90a038624e270e739874da3fb2f8532295c730c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009e20af6481cbef8ad85e739cb53395748e7415f0486542f637f6dd2ba28dce05000000000e8000000002000020000000fd06c29ba9648d57992e19fac1d652ef652fcee1c2ca5503eb9989d47c964ca290000000836dcf3e481cbb23286192c05b243c11c796d870182e677b43787410012ff6450e493dbea9e5f3ddd798bef885794dec229a07d05dbaf5d19e1d2e2d2e5198b5d8a3be5b2da1c4ae3c1b9295521780502f559c342900522539d318b3c3d57adc90e1c9184c5a7f2bb472a0248ab6eb036729031605eabbf730ddc8f4006ae27c3f53ced49524957866a5a425f473844b40000000971bac6e1c7f0e86d2cf2b6a608c5472e987dd3e282bfaa89acc1ed867f34bdff40e3cec4e75c0d8d1fc49aca5d3b679c89964a04d8823d1330b0d677f2af21f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e31b6e074eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8041B341-B9FA-11EE-91A2-464D43A133DD} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1692 iexplore.exe 1692 iexplore.exe 1476 IEXPLORE.EXE 1476 IEXPLORE.EXE 1476 IEXPLORE.EXE 1476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1476 1692 iexplore.exe 28 PID 1692 wrote to memory of 1476 1692 iexplore.exe 28 PID 1692 wrote to memory of 1476 1692 iexplore.exe 28 PID 1692 wrote to memory of 1476 1692 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://vjlhg7.za.com/1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54caa1603d8a2281ac840470c43bd5a7f
SHA151925265a2dcecc19e89beee1789685e4cbdc8a6
SHA25627f4430e45c3e07525082f514849e7f3425b12a61d01d578b3ff95d5542f5912
SHA512e0220b5aa1bd4bbfe5de54ba55380898cc503110abb505e86e2c4d4b69894e0c3860d7e416bc93cbba7ac296e53921a6823d58fd26a3a149f1c25a743336c53d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3c607025dfc4ba4b2c1ac152bca15a9
SHA1795c5a66c0fa9ceeca98a66a048aee9c291e4070
SHA25621fede8acf745ad0da6ee683bcae898bfcf9bec184e4c109f60e82fe1d921b2e
SHA512632debb513059900fb692cb7843069df31da5a34dd8901aff1688a6f3b54a8efcd0d6f17d8216824a058de8eae4f7617007ff5d7a8b08b78d70df593d1ad0ce5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d716517ee513247943572546936eb0f
SHA15c8872ea6df910cb8cecc7df2b8544f5a426d21b
SHA256d652787f76ec7f5ba3ad1708c27521902150003b4ff4b8e5d64c06e72795e08b
SHA512c5281d10eb0c89f6196835dbae16f3de745d85dd402b4a28575fbb3ced1972b293b3fa7835f72ebbbc711ab8631dfd08c3f16420141c8ecd9b16ec183d34de2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fefbe1b547a932e737f4eb0091c59f3a
SHA18a1b91b1b6aa7dc77ad1d37d2dba5fb432a8cbf4
SHA256fbf032cc5564197ae913699440bdfdf293786b11609f9ed0bb3342a1c304a5c6
SHA512e07040bc29c6a867869176f1c323a2cf9b2dad64acb8bcffd04b79723ec42a038d95e806f00101daa9a55e3c401e141c7f951ef2e191fbc42c6bab646d2cfb72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d14e029179a9d6a389bf63701d292c54
SHA1dfbebaafc27eac8b82803726bac40b5d92e4ecba
SHA2561725cff9b6924c3bfc5b1c4ef3f462e018fdee456a6737b8c137af8b9ef29bb8
SHA512f9de274e9a2114e17163df076d28c1a8581a3d82d6f80007d9e2008456d9417c491a23fe939b35c5541336de36ad524346d1a52dd8d6988e0026e533c7e15342
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d366558946a16ee77026cd055d26014
SHA1c5cc2feffa6d2452cd2a15c8a28affa52e1b4c6e
SHA2561dbdb02a14d1ea3b52dc10f78ec4443fa02546f7fcc6583a28b7727e6e0ef59c
SHA51217392e4b76d2174a79b045f70231dd01cb95b9e2238d2f393df111167f6d4ce4503c33cfe09bcbfa29ba52dc2c96dcc161bb711c7826cb41d1d03ec77a1223d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508d6fed88bc1ac0701ddcc72f39eadb1
SHA1dc92b7a1a59ca7dc772cf88a03454ff2c9b1ea7c
SHA256b271e359644c93a357de8cb0b565f71884e611ad656d29e5aa608351239ac824
SHA5128685b1739e3141e190e7019050b100ed6fbe9fb66687044c8947696c572acf64bedecde1529634e43422423273772fab37b014a0f6e3d807a69a60fc7806bbde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b345273a0dd7b97a92d8839c7f95d535
SHA131153a5854eb5885e3f2cd5ae4c16da857cec6a2
SHA2567a100d15b7974026bdf5bfe4a08543f2f0c8610580ab2b68f83df028e3054073
SHA512891c82762bf3e9656085fcb7447f1f5dbaed0846f058f0c24d325709c451e89e54e2139faa7699c1bd8a35d6282700a81d9f9fe488a50f672e126929600ceab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf06e76294e812389bec44cb540c2d20
SHA10b9d7f865aeb2234ea2f3895cb3ac8d9cce86593
SHA25614590f31b494bf7ddb0fdbd511b498366d07e3d8db7c06982827db6cfe277261
SHA512519c729f58a5960a27722048100b93415fe535b6e554f202923bdce4fed3ae7adcecf77eab4935f94a9e0812a71c9f9c92e94c75eb93bce14fc1f58f8417a8b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2834e719b69c33c627beed78a3367c5
SHA1dbac7b64970cdec15852b015a28a87128853a33a
SHA2567efa17b21538868dbde1a63623ecadda98ddf40d3df9e614b7471a2c3e3c2564
SHA5128ec0851eee985a9e481b0ee0e7741056fb32cc274a7e20a363904be91d8dd0cad83f31e4eed592bf3f0f98e0e97741f965a6667fca0e401c4cbfdf59482d9c49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b1a9082e263eeb7a79033bf4efcdab5
SHA1285369ef048bd64dbd2da7fa1024a9d00d60d269
SHA256c5e68bd851862f915b393a0c9e5b40a381ce37aeae33c8118d6f3682bad6c59b
SHA5122e70e3677b816a7ae0438d0365ff5639d86a0ec5d5ce00600fca84d0f63ba828fb2d3487749c2949431f2ce617e13ff097d2828b1d0961979cc1c3c2ed118f80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559d085428cd7845d39e1fb23a200f30b
SHA190e915d5665fae06934ab62bed91d5e9a2d6d817
SHA256f421fa681c22cc7436d175f6ed17d4fea88ad375ab344b2e08e0c0f8507cc5b6
SHA512c9c771ada762b3a6de183d56e7c5ba3fbb241355ce2de85e96ee3030d91597b688db589396c7ec2aa47e7e33b8ac3f7221dae89bfed582d6dce8c1c51e09952c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3711c04c4021a469e32bf83de89728f
SHA1887e77f4e91cd2c4061e69489f141f9e605c1c8d
SHA25654c5ba8e829401d9ac35d4b893d778dd5a10ac7e3a4444ef28f8b42217bc9ec6
SHA512bad5c9ba00a6573af3155313a00690a291dcd422603d64cd75dd537d57215aae6098c9877a23bd331955228ae90df1e66fa799c96d7ab7b0daa2526018c618f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ae4add76fead12ec51e00a5ce67a4e2
SHA17b63ad3658ed626ee59eba1bee0efed0461c6c62
SHA25654f9d1eff4082bc6016012e29ba3a92fcdc1d61c70607b92367f23e00021f527
SHA51202bd307f4d35d1c2bc153e6bbf868644ec10bf7fc44ed67ad0746cd02c747b7421cb0e5e1a5da2c23eaad1d6d18a02feeb9a938b568ff1c7d540cef7cdf7fc5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0f178ec963ac59702fb69b4dcbd2e30
SHA10bc618a68deecef2f0003349e09ca1854c055669
SHA25601523b1aebd5455c003dd692c5c30dba84d3b15d81d6010268e2882b5460a982
SHA512325b7602075a52e13fb3721207095e4845c886793422f6f69978915146165086ca4980af67bd6e448c7b416ded1beb2f3183943330baab2600b8c3d3d81ef890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f680764d679fdbf3f528e4347f4e2c3
SHA17b40ba51d30d38ea0a9617a5b08d2cff6eb5b65a
SHA256ba086c09fc2a304117b5654a3ef314179a677575d480acc5faf1e38f6ee29b6e
SHA51259642acb7da17f3d9b17bfc0b9f50fc5d061f0cc4293fa31b281ddd5147ef72a6b22eb7e11ef7cac77efdddf00ecf58dee29d15fbd40108443410d74bf88c179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56463c16da2c7859d3214c3956cd00753
SHA198cbb4248ae260d03a6477fd59058ccee946285a
SHA256244f5ac76fdcd803f4ecc4e8ec776e688d18ebb59dcb997a4418247304471e01
SHA512fa51878d4ed403237aed577ed8d95b57063dbbd20b487ca557f227bdc7ce20df3d25706c065457ee30da5c572a84f40b854fb7771101d519bda3b42d666eef25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a906cb3d60778612b77174cacbf5c22
SHA1c05ea8b664eddb0ededfabaa6d91e0d90961871a
SHA2560f18a459b58cd58ae98ba5c72c4cf3e37ec4ee101d4e0aff6ed8cc003df2cde0
SHA512791397dae71b218ac034af198f6cb57cc7781e9584cf1f93aec0bff4dd3e99377870c9587d3221713ee4e041e030287c6dd08cc962726964c0e51383bb6d3fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cd1c1709db7e72797db63058cabaa47
SHA1d54783ec904028aed3ddab8a6d0dd8683c3059b3
SHA25609d6d07e973de1fefd09970f1325b41fa0614c0f21a1aad53be9998bb7c3d929
SHA512b9bdd7110f73e1edfe9b86ca22fcc947ae51ad934bb16560ebefc785599160120a7fd75ea861d23144a5ea35c19f10c708ac12272d0e23e8252fdf731db841a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5661f79d2279bc5caedff0c746c8cbb5a
SHA1f67f24785ed581569f359460a1cc6f12a5de1265
SHA2566946f390caf62ff1bbbe041e7f7dd2d2efa14f56a6d9249beb301768451c1789
SHA51209e5ad7e9e862f2c062799152eba75757817d97754608bb8401165b3ad5106c6a03be51710e4f0873516eddc60a1019adf7d4993e6754b4cd55e211c31586f85
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06