Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3_16ec2e4e-..._2.zip
windows10-1703-x64
1_16ec2e4e-...67.zip
windows10-1703-x64
1_16ec2e4e-...67.zip
windows10-1703-x64
116ec2e4e-6...67.xml
windows10-1703-x64
1CyveraSystem.reg
windows10-1703-x64
1Logs/Traps...tl.001
windows10-1703-x64
3Logs/Traps...tl.002
windows10-1703-x64
3Logs/Traps...tl.003
windows10-1703-x64
3Logs/Traps...tl.001
windows10-1703-x64
3Logs/Traps...tl.002
windows10-1703-x64
3Logs/Traps...tl.003
windows10-1703-x64
3Logs/Traps...tl.004
windows10-1703-x64
3Logs/Traps...tl.001
windows10-1703-x64
3Logs/Traps...tl.002
windows10-1703-x64
3Logs/Traps...tl.003
windows10-1703-x64
3Logs/Traps...tl.001
windows10-1703-x64
3Logs/Traps...tl.002
windows10-1703-x64
3Logs/Traps...tl.003
windows10-1703-x64
3Logs/adapt...log.gz
windows10-1703-x64
3Logs/adapt...log.gz
windows10-1703-x64
3Logs/adapt...log.gz
windows10-1703-x64
3Logs/adapt...log.gz
windows10-1703-x64
3Logs/adapt...log.gz
windows10-1703-x64
3Logs/adapt...cy.log
windows10-1703-x64
1Logs/corte...ad.log
windows10-1703-x64
1Logs/cytool.log
windows10-1703-x64
1Logs/cytoo...rb.log
windows10-1703-x64
1Logs/foren...ts.log
windows10-1703-x64
1Logs/foren....log.1
windows10-1703-x64
3Logs/foren....log.2
windows10-1703-x64
3Logs/foren....log.3
windows10-1703-x64
3Logs/foren....log.4
windows10-1703-x64
3Analysis
-
max time kernel
111s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
18/03/2024, 19:41
Static task
static1
Behavioral task
behavioral1
Sample
_16ec2e4e-6cf7-4e69-b2f3-676c8263db67_2.zip
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
_16ec2e4e-6cf7-4e69-b2f3-676c8263db67.zip
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
_16ec2e4e-6cf7-4e69-b2f3-676c8263db67.zip
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
16ec2e4e-6cf7-4e69-b2f3-676c8263db67.xml
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
CyveraSystem.reg
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
Logs/Traps_native_log.8.1.0.41560.etl.001
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
Logs/Traps_native_log.8.1.0.41560.etl.002
Resource
win10-20240221-en
Behavioral task
behavioral8
Sample
Logs/Traps_native_log.8.1.0.41560.etl.003
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
Logs/Traps_native_log.8.1.1.43337.etl.001
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
Logs/Traps_native_log.8.1.1.43337.etl.002
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
Logs/Traps_native_log.8.1.1.43337.etl.003
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
Logs/Traps_native_log.8.1.1.43337.etl.004
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
Logs/Traps_native_log.8.1.2.47081.etl.001
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
Logs/Traps_native_log.8.1.2.47081.etl.002
Resource
win10-20240214-en
Behavioral task
behavioral15
Sample
Logs/Traps_native_log.8.1.2.47081.etl.003
Resource
win10-20240221-en
Behavioral task
behavioral16
Sample
Logs/Traps_native_log.8.2.0.46986.etl.001
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
Logs/Traps_native_log.8.2.0.46986.etl.002
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
Logs/Traps_native_log.8.2.0.46986.etl.003
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
Logs/adaptive_policy.1.log.gz
Resource
win10-20240221-en
Behavioral task
behavioral20
Sample
Logs/adaptive_policy.2.log.gz
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
Logs/adaptive_policy.3.log.gz
Resource
win10-20240221-en
Behavioral task
behavioral22
Sample
Logs/adaptive_policy.4.log.gz
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
Logs/adaptive_policy.5.log.gz
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
Logs/adaptive_policy.log
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
Logs/cortex-xdr-payload.log
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
Logs/cytool.log
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
Logs/cytool.taylorb.log
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
Logs/forensic_scripts.log
Resource
win10-20240214-en
Behavioral task
behavioral29
Sample
Logs/forensic_scripts.log.1
Resource
win10-20240221-en
Behavioral task
behavioral30
Sample
Logs/forensic_scripts.log.2
Resource
win10-20240221-en
Behavioral task
behavioral31
Sample
Logs/forensic_scripts.log.3
Resource
win10-20240221-en
Behavioral task
behavioral32
Sample
Logs/forensic_scripts.log.4
Resource
win10-20240221-en
General
-
Target
16ec2e4e-6cf7-4e69-b2f3-676c8263db67.xml
-
Size
4KB
-
MD5
7abb1c37089c3f0acbf716a750771100
-
SHA1
54e0104b891805057324c30233e0003bde94c663
-
SHA256
2faaddc8594ac967196ff0214b132527fc3aee72691b5f9a033ea6c047e62beb
-
SHA512
38452059ff42131b56ae96a788477c85532f10ec4d7006010b6bff9e8ca189a53dd838110394072c2d6af45fb36f80da35ab97cec47bcf6e55dc75b6a80cb460
-
SSDEEP
96:wanGgkoiZhV0v8/dxFvoxoTTrqIR0pz4ODW4Eb:jn+oE/d7oxo2IRW0Tb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005cc9aed40953a94f8ac84af15fef74e9000000000200000000001066000000010000200000007d0e79726eeac0173e269a1b02074e529ffc46f72f7afd6d94eb5902f20414da000000000e8000000002000020000000b1a1319753602c3359b9134f5362db84fe10b681462cf6d0bd2d73af09ec56c1200000007079ab01b0681a3cdc54a72e9a71a23c986c7821a82838a422fed1750c52b62a4000000026566bc9a9c3a31867c9e1571672f85a6a02405fe9ec7e853708ba751827a7f453e94eb125840aecd3dd53cbe01ecb30438ef0887d328c171f2b86d8a6edc8e9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b5678bfc79da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "417666382" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095292" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095292" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2322740579" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0117d8bfc79da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005cc9aed40953a94f8ac84af15fef74e9000000000200000000001066000000010000200000000d5a3e54965489cbdbd273fca4782d4e95f499d776f81ae3540323c29bf5b130000000000e8000000002000020000000dd9227c89e1f2f78247df539aba0732207f4711db959f13ab514abf378cbce592000000025fce483dd8f36c6e6c9b827f9b13b03592b17e2d93b65f56b2e7ad2d397496a4000000087e34dcc0faa33e6200cd8dbabda64c697157425b897a066a83e87f86839ec2ef000588eec2d180862fceff747615a1df03056a9f94a46a5951038d6a72eb332 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095292" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "417634391" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2331488700" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2322740579" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417617796" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B536DB78-E5EF-11EE-81E3-DE3BDD584807} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1531961169-1615826105-2188682873-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4912 iexplore.exe 4912 iexplore.exe 3356 IEXPLORE.EXE 3356 IEXPLORE.EXE 3356 IEXPLORE.EXE 3356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 748 wrote to memory of 4912 748 MSOXMLED.EXE 72 PID 748 wrote to memory of 4912 748 MSOXMLED.EXE 72 PID 4912 wrote to memory of 3356 4912 iexplore.exe 74 PID 4912 wrote to memory of 3356 4912 iexplore.exe 74 PID 4912 wrote to memory of 3356 4912 iexplore.exe 74
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\16ec2e4e-6cf7-4e69-b2f3-676c8263db67.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16ec2e4e-6cf7-4e69-b2f3-676c8263db67.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4912 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3356
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD525200eeb2faffa02c43fb57844135379
SHA142f2a5ccdae3103e22905d24b689b8cdf253e044
SHA25613eae90ccfd447309e278c9382d9c041a8439ca3665cc3d517242f1ecbb2b6fa
SHA5125ef629bbe691182413cc6e159f5df31a3e5117c745309239db1a736c2516309dc0fcbeeb8f34c82fde124d1ecc8ea2e56e077e0caee80a45554e5639425f2c6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5f0f1aa2ee0b0e7de5a1f32c40b2648b5
SHA1c694c4d28f3daf5d0f90229afe427e9cf47889e6
SHA256b9efb01e1b996690490508f0678c0df9b9c23fe59635a2f214db912b7e3c861c
SHA512b6150bd824ffeb0ccce1731559d711e374feb8f7497d6bc0ddd63160b0d2240316829e708f3bbe1a2062e2ce7845a18e22cdcfec588f8de7ce355de30dcd986b
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
543B
MD5bda3601867a71f272086025670dea709
SHA14f3e73a233222368fd08ae1e309799b615fe7837
SHA2560b1448db11f782b72f49343091e60a711bdec090e63a1655132cacf8c21bf404
SHA51254adb24eae3b1b282f1d2b97e0d2a0ba7d6e70d80d0383f0fcd677920af79b25b9df46fede99c32257b7a3eeed6edb14fd3bd3d68a5b705632cd2d5319cd525f