Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
SpecialPrcPlcyQSvc.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SpecialPrcPlcyQSvc.html
Resource
win10v2004-20240508-en
General
-
Target
SpecialPrcPlcyQSvc.html
-
Size
4KB
-
MD5
951123df3013fb7653f73030694718f5
-
SHA1
e25f7b44311fd79af32b877e4379951e98b98bf3
-
SHA256
ab25e0f80e720a6528b97a3bd396f78639110e11303dc7e1001c7b56298ede26
-
SHA512
d9ad89f64210e50b5ce15490ff3cf7ca09c76f5750b6a1979318585aafe9cebf7f9030f25db2995ed43482750d03ea7366522ee6919da725774edb6eb8c94810
-
SSDEEP
96:oSTJBHBJDJgJLJpcJhCJz+aCJzkvJd1JzUJcJzLJgLgvCaRJRiBCFREyRUswqL:oSFNVM9OAOUdDs4JAg6afMwnh
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e8e05333b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F63F941-1C26-11EF-B3A2-4205ACB4EED4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000095270483313a4451c1fa202224646113df4c9d825e12e18a262ed0f947b2b4e3000000000e8000000002000020000000e81a7990e560b8dfc701beb7196c0b280cf001681cb8046b1f9ffa331e9813c7900000008f39835bf38663d4ae7f68476a47fa48a717d8d3b9494e2c6b77f03c17ecfd9b58e37b05717fb0b9e5a7a4a202fa2a9fe7fcd35f2b8a869de8f3e943cab2f290c550bc0b907f33d06ef831a9cb3b77f9babe9bd57145c161cbdfb656385b0c99f85da742856b495842f88321df5fb8919d5b4d12628f39e9bf109cda2c5dae1b04f50bc9e56ec82501756f435a5b207b4000000019fd489b41c36ba716f0638d6177c147e75bb4063bf4129a30fa5e039a3b396076977b5d662b026d81e95d4bcc2cdac15e162a83b1faa25018a3dadc0896d07b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000003750552d6321bff0c9a5b5d8173f2c5f2253b7a4c76d6e5c3de69aafefdcf2ef000000000e8000000002000020000000c1fe71c2760bc5251666a058764518469a864f6cb1adb36f6844264016b2573b20000000a1133aa876545a2e1e6ee698afeacbcaf22f900ea97b18aca1607e2494fecca24000000085df08334958e237df0bbf4e46a6900477c7c81b10165ee053736bdbe6c92c718f046f7629262c9a5199bcc7b957f5b42c64a511c51352604771b4b7912e81ae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422975581" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2152 1984 iexplore.exe 28 PID 1984 wrote to memory of 2152 1984 iexplore.exe 28 PID 1984 wrote to memory of 2152 1984 iexplore.exe 28 PID 1984 wrote to memory of 2152 1984 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SpecialPrcPlcyQSvc.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e3f889705486ab7481c00711bec965a
SHA1ec97fec1f5653514576975c86322e1c047d293fa
SHA2566db0be7f768a6afa40876e6c4d899ca35f6a1be7312e62935be9089e10ddaada
SHA5120a863baba9f05232766fc945063695147d93c07c141fec1100c3f2c6d50aaa2601eba47e4126cad745f71ee599979b234575471e1ca6d8be63ce70e028af7c13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4b071ee50a98a4e3ed8c647173723c6
SHA12629d651d66661da0976d8e73c6a1c02c52e3095
SHA256e9ae4b038de1afdcc4beed2166522644aef1842737126066263df0e686f61dfd
SHA5129af10854d1b81d8f3fb77c3f3f8d324d86e9fa238d9b37282ff1d92dc6db91bc3d2c46fd4cdf2eab22d0a4ce58e431ca7bf1fa421b68206ceb6535dec37b65fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2717bef8d532eb24cd8cfa480329118
SHA169474ade068a80b92c62f907acc465d30093e8b6
SHA256cc44592c7663f56902c59e221d5ed0064eac37c6e9be99714b300b4fbccdd1ca
SHA512632feb9ef1de1497fc4cc3add470cc79dc2e3731d1984e42ca583f51c751bd1bca07e01935ed722a447cfd485f7f4693e01dfe0c01a327ca077e653a5dbca9be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500f88670252c98377b15b3f8854004a3
SHA121f855d04b05d149991564ca8ab94e778c3833df
SHA256bc926cd253f8c488b9c31c3e8e9713ac0fbf1a8f14afa1e62daf3699074fffd4
SHA512987cf2a7ddc6ec89c95887b5ecbdc813083b9adb6ca7674e12367930c4435e43d8ee6a60720bde17d65988a4b6d7ebcda7074e848a800938caf1a0250bc68227
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2736e5caa5d02830b7a8df0554416a1
SHA1261ea338485b80670a50b90b994bef17d2bc35ef
SHA256f2edeca0fd621c19a1b4d926c069e573903c5192301f2fa0fbaf5bd35c83e49b
SHA51290c89a296b50e6204baa6626f6c4887a5f6917b73195d16957e442358cd9fa57448909d872dd2a849cf95ea050406482b79cbcaf638e5c5c93bb3974b90e82f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528306fb261ad4858ee25862c013313c9
SHA12d8a112a8ba17daff5e7f06490f3897c3befbb0e
SHA256231bd2b0b9924a4e595300487c54451080e0fad300c7afdf0c4669144f013fc0
SHA5121be1aee114c2f2ddfb7de3dce4df8b548cffbc00a50b1d1e1fc3e5011f979089c058b174cfbde800e27dc1aa2f832fc5a7e358f9d94330513ace96bbc3bd7348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb291df4515f1bf76255d00bd01f74ed
SHA1473d5940d243384eab86e797630cddd3037aea08
SHA2560ce73421aa11011867a9cb6fe152e72d5172c651280bb4cb8db0ea393503b87f
SHA51242770b1d46ddb0bca9684567cf4092bd625eea6b15d7982b7c5e495ce1bc59df1eaa264ec2a0ac575c66d2ac371607f18ca3fdad4334471134214c4895c210d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507968553f1a2e421ee4136d96a90b86e
SHA15b6cf743b2e4b3eefbc70c7b96feb3c9c1d252d6
SHA256637d5f9a65aff704bef3c4df669f2e6c206c064979fdc887f3a3898db34ff06d
SHA51205c8e45364e10fa56b9f8dc9f3df372a0c272cc5798a13e13c41427315c7482e1601942bbd66c7c7903749b12b5602043b82bedb56f65dc233bf5e24c3ea51a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9ef9ea34b454f2ea27c50b4b1f2046c
SHA173c1bfab288a43c66b0af20608db55ab0f6d7935
SHA256b2e7dc2c63288b85c623583f3388da589f317dd14aefda71950ffcce430b9647
SHA5124fc193e9047bfc503afa63bcf61e2979d8808b89f6d3f10d0914cd26d47aabd2bf8c5d7303060da3996ec546c125a5629d224169f6dbc79dd541a55ee5ea6f5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cd5620a84b64cf6a1ce36dbb2315937
SHA152fbba90ec2d0fb5d58928500d5e03cf428ea79d
SHA2562f8b05edeee9ac8bd8bcaacf15a3183e36c09f1bb1b8ff54b0b0b636045d4838
SHA5120123e10d28c656dc107d74912eace9e69b848278d6a34691acdef04f1a545fbef2b5ff6e1cbb2c3f7d93fa8b4325b056f420df9e95dc166db96f1d1407c6881e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557593b283f55bde4345c8764568e7cb4
SHA16ade4ac8c9dfb84e097b68d541c8f8ca59a3464e
SHA256023c30707d809333986403686d52cbb83ea286641794eecb7951ca4c9309be2a
SHA5126446344fd85beaf11b1cde1978537fcf86cd61a61f8354e4072f8f45883402b179c6c53e2a74b37c74cb793151c263e3b2cccdc9bb37604d032da8d226952fb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6a13008472c01c3808cff0008eeacc0
SHA1fc9c18696a601038c2ca4c258ddc1c5f5d616cbe
SHA256cb73adf96d070d0a180e31dc59bfda977a40225f44144b24e35497ccd8647657
SHA512c71eee43b0ff8715fefffe8622dde8c282b4cd16c21032a790effb5669b3d3cf9baf048027353c06285d407d32f498a71c2f5db4358a4f9064a920f984b56089
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5092bd8205ed10825210cd61c9f8a29c8
SHA199a3be025c762cb695473694951fecd56f61320a
SHA2564d157c82d8f51cf0825f1666ba9194bd043420e2266e5a5b5048594cdead292c
SHA512d85e0343fcda0e86d510e226a64b97bf98e41ce92420254e033cb0109571a29e76609d17bf3ef9c2a7972448bee015f8785e09b2d817d0af69065cd494f9727b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2a32adcf83c618baac755988072b22f
SHA1c6a23d6d123d1e0fdd4e66912f19b59d290f644e
SHA2568e5b728a3d18533ea2983527c72da17affd6d5ca58acd5e4ff48a64914730d0f
SHA512386ed5f621315bc828b236dda78b989f97aec0c0f458dd086f67debeaf901cbf8222eeb8754affb815cf5afecf1df010941c4285ad7a6e81dd212a348c4d6616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556c19cbe3509f658a7b00999e204c617
SHA15eab27c2a4c659d87cfbe00bf7a3d9e83d8508d6
SHA256024eee2a53c4a5f148588292a369969a089f79bf808806ac3bfad2044d08fae8
SHA5120a07d1e3d565a9a3299075e5e8dc214d88044033f2f8c4c33162c942b9527c49937588365e98b49c5564dc4ddfbee7e98a031a9524040636065579e708797219
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1a09fe75fd9ade71cea5658094a64a3
SHA18b21f602f068e4cd7dd275d772174566e4fdbc72
SHA25652e367f6f587ba38979fbbc79c6774c9bc3b18c6acc6253833ca9194af92e8d1
SHA5126402436ee0e8c6099c0dfc06b88a0df6b6c028d083f2f724103dd49181c8422283d5cebce3e862c0aa34b577f5bc5b85a7f5dddace2d3852d27b06dee12bec24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a51a33db9ad2f4480903b09147bff5c
SHA1839f1c02d1c4cdb33303e47494375dd8324cc0f6
SHA25643ef2fc3db58a1ec566a3cd15ab7205a5c3603b5fc3c8882a359b679058da38d
SHA5122fc3bcbf93941a71f3ee4a607d8d698ef49dd36621c16ad88874838e0db89b583757316f5b1faaaa8c3734f61aef41e27b8f9321bd3101e9b15ff853aa85c4ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574c90a6d000ccdd6de6e64c379a0ec83
SHA132377116c1a4ebd252d23ab0870ac1d56b0e5e81
SHA2562a4be54dabc0f4b39419e703965f5f34de64835fbbebd53a0bd3bd4d78458af2
SHA512a3fdf21ba3d53b5c1a6e726ccb816b61e14d4a9e92efbd50c0b4dfc7d65278490a91e6e26bcf8b105eee3e340dacc007c3b4a9f70a09cf95b6efed5cddec3e1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2334ee1b73b26527b2b14e80c1f55fd
SHA199a331ea8ad18c9ce405ec8d1447bb393bad802e
SHA2564d2be66e0269273d552934a505cfb69c4ebe6e680718a5cb666b75b50ea9ddb9
SHA512151f5f901cc7f3278eddb3d33ac659308a770017dd9dbb877e9746716822f9579ec07310c065e40204be7f45086a753601137bc24b2e91063d24d5a40098faf2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a