Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
libtaglib_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
libtaglib_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win10v2004-20240412-en
General
-
Target
libtaglib_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
-
Size
6.5MB
-
MD5
26c8f3c129bad20d23cb0bbc5b490a54
-
SHA1
932bc529bc1174e2d7002dd55b95dd1bc71975f7
-
SHA256
e705ce7c714dc3554163aaf48a6db11564c58c104683d8834ef637d30e054ab9
-
SHA512
0f4724d685a1686f2d77891202111706ab28ed9d3d03747eb295f0127f33a8a7eb3dc0965ff3cc419dcf9f6af38dfb14f14c83367a92c40b58c12b68a07f6953
-
SSDEEP
196608:Y8Mr7zGawTt9tAw45+/F3ZqA0AX3Ba8Tmj0vg6nVpfn1PYdpReUH:6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ab5dd44892da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000391711232c373c25e53ec949131d598ca9f84a8c172fa7866361373e277b379f000000000e80000000020000200000008176fb05a70348758083924b19cf83660bbce0945ccafd798cc9bc845b48238390000000ad66d58f58dfab19d8592496dd56aca0c28e009a4faa9a1db2ff0f7ec943d788683d122374d59329a7ea6e3cf2f6ae382923402fb8a0f268bf85b4fb75e6b5c50b8f299026e20278aa4bb362f317b68a5f4eb2b44a1b735f0c04ae5b5331f101e9adb7faf6e2a34b01078d15873d0ed86087a83060b1f26f778a948930ce6e13e0ac5059a6d358c59d1e1137ca98e2b740000000e03dfe525f7c1c1f8b670717eaa969db7679f4da79e68e3cd4256deed1ee2df6a78ff6de06de33dab3a06f507edcd3366e1dbfffb754690e095eddf20972b853 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF366AD1-FE3B-11EE-9DE9-520ACD40185F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002c9d2c3b1dd47becbbeaa4aa3f8459f3395e6b6426cbdcccb0eff87971657dab000000000e800000000200002000000072e0cbad7ae275971fea2a0b1f75862f1a720f9cf79d27afff7815d8390ad0f6200000000f33477bf495f2f8382cafcc33f20faf1872922d5d50f761c68ac9c46507c27840000000a825fb83627ed97ad3b41a08b0d29cca73203e7453aabbfc5329cc4d17398a9f572a6a4166c0d7d8d4d50731a818424104cc0c084a7fcc9d58bc320150a93336 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419686280" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2956 iexplore.exe 2956 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2900 2956 iexplore.exe 28 PID 2956 wrote to memory of 2900 2956 iexplore.exe 28 PID 2956 wrote to memory of 2900 2956 iexplore.exe 28 PID 2956 wrote to memory of 2900 2956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libtaglib_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5695339ec6c01fd8f36ad14950d4e551c
SHA1fbd58bbdb871c6b7f0252590d73088b93e7eae9a
SHA25615dc860c156838255793cab1cc2806ba09a4984089f2d61db02ec82bcce802f9
SHA512a346e610a7968be60a529cac9cdee610cdae257acc8f01f72b031eaa106b9bd77ed896df2467d2220beb5878939c60e3e5dca5f863e2a5f194e596d202d3d806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54759a97929f7829fb2c535bcdb65a461
SHA1e7961af5f19e04e2a98c95cbdfb19e529717504f
SHA25652241264ede17dd9221e1e91fb3fbc27e82909afc1b35282bca661c07289818e
SHA5123db68b516894911c48212cc0727dbc0a474356301f75ad9de02a0ab3b1ba97623fa7ee09b942d4f59576af0d864407e6392e13adb42aa793dc0a1abac5b5b395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526fb7f7bdc238fb4e1171a569c517550
SHA1bd86619dc0c24e4ce76848ee2aef76f29c591907
SHA25652e7f853a4ff2f367533e2f6a6ea59bbb340ffe6d6fd7cd8ae722cd8661135d3
SHA512362bfe375b223ab0b39604066413e1757324841144329fc44c80c8e7ae51e14ed5819f53c12ec34b4bcc4504e8afbdcddf850c870ee35f6f62a17160876382b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599b6cd3e510e72ba6b1fa21ef57502c9
SHA190455b4a03e0b7657ee0188b1eb064e0dbee2960
SHA256e3da170a0c649e7fb84b3d1591755ffd7be9e12cb008968a41914b5f000c9670
SHA512b76e430ff1c0510f87d4e983058438a0d5df1083c293238446442c54cfea43a1491f078536c978b0de81af82d4d7208e293b193295d5bfa42180870154d8a6c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52515f425bfe265064a5b466cb9088b44
SHA1d3592a4a912c90721a94cc51c5acddceba253be0
SHA2569361c3bc499b4bddfde45a540df4daf31de5779420b0ec16f4addc7064592bb7
SHA5124997bb18e918ed26a1b0989539cdd5f2cd82e6169bff5ad1d7767c4222c586a731b2dd49b5d94fb1c65702694a0c0030e86db2e1e8c4ec449236e3ebb7bfde78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508f06d0346c175fb85e89b2c61e6e22f
SHA19ddd628c91df203eeb48df18c676c438da469394
SHA25672121530a717adfdcabd375b59e655bca8b5cb05f81f6cf1763598b7b6911732
SHA512553fd0f8daac4e7dad246099900599d85f9a43498212fd49d1e02327cc47fcfd25a34a2352cbdf86e28da000af05d2ff526988f0842cba06eb7e733a910c3c96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb38bed7824aefe638ba49895ccf41cc
SHA1c4bbe95103279754294adfbbfe7d0cafc4a2e48e
SHA2562a725addd0748b7a0b226b3747cbb07fc1c8304f735b6f8dfc3d661005641ed9
SHA512e64b300606e21b122040e8532eb2055bc3a8e7cf7465fbf389c29a9368bdf723e60b9a0ffac9ccf093c63edcc450353b9aca15d4b57749dbbd888ac2d2b10c2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545f1a7c45b974b2c2a8bffad357f9bf5
SHA1faf0ccd633d202571cf32a8d32eb0fa65b08da96
SHA2566b8ac34f0b5634aac139a97812378bae5ef9fd2ae3d7a13c33f16125345d1a79
SHA5126ba617a53fdd41b36384ac35365d98ce1ec7d8f7ecabd77e5c77aad0684cafbf7a93b9417482b312ee15ab8b2fb25110a20b3ec355061adb4e8dd091e2074c7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d0db5e26312e87c3ad259b72ceb9979
SHA150214a5f6ad5c35f93ae3bfa3855d811fdc08dbc
SHA256d4328c6acc7124b86858f1fc39506a459c2c119c38320c7a30034eb96a84ec13
SHA512ff4d6ec150f1c8a79a5885cf3661672af29ba80fe4f1eb504d7f53fcf614717f9955d23e64addc07390adc4f67d2eb42bcc583daec500964851ab7feee6d1d49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8a4dfee826cddb2953bb7367f1bc490
SHA1672b369135c9ede6029687936d993b4a72c115ea
SHA2561981921805e13dfd342b7da06626994f7777f6e2a1163fb97fc38a4b014f298c
SHA5124436f07d7f20e9f1d56f3fcb128efa2bc452c596c5d5d8069944e402dd3f45875341f41fa1530c3e42d1c2898a9de25a2382c76d3dfe4c052c785ca7531e99d4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a