Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
194s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01/03/2023, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
b5bc4ffcb4d5e05b6cbbc2e24a1f8fcf618f90d66aeae4e4a5c24961feb6dffe.html
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b5bc4ffcb4d5e05b6cbbc2e24a1f8fcf618f90d66aeae4e4a5c24961feb6dffe.html
Resource
win10-20230220-en
General
-
Target
b5bc4ffcb4d5e05b6cbbc2e24a1f8fcf618f90d66aeae4e4a5c24961feb6dffe.html
-
Size
9KB
-
MD5
da478c7e6b84a10be0afc803798db947
-
SHA1
bdd75519f756eb4cdc8b2bcb4d7ae0b255fab703
-
SHA256
b5bc4ffcb4d5e05b6cbbc2e24a1f8fcf618f90d66aeae4e4a5c24961feb6dffe
-
SHA512
2fb49a815297d79e8cb215cccb2ab2900e9f34638964d01aac94c7fbe96f7f476b3b66305009ab815e35cf65cc13bae1bb8afd21e2ad6e219ce99f95c5cd0be3
-
SSDEEP
192:ILlg+wuv13xV1cSHYumoldjIINNMkcIk+Lx4AgCXtTHxxSZ1yz:I5g+3v13T1FH6MNIIPIIZLx4zyt6u
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70fc750c944cd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc000000000200000000001066000000010000200000006696c96e57a758c66286610baa40058e1fdee16fd8210bc804afdcca2502608a000000000e8000000002000020000000988e909ff83e736d3279107b17472e3720f95e6575928b78af95d3e0b0824c0c900000007935a753c8bc7857d7f0c993d954362b87e251ee5762acdf8f7f8b54b8cd304e68c602cffa6ca70c6426af92b847caa3f021e51304a69db37509cfca57429cc20a65b571e6dfed8a3cbf155da990e67130b6c07f10f3609e8f6c80e53bd646c26088e2db796ac036d64bfc23d2050c9362a80d70e350ab48997f4087b212ca924916f80e4a381c61e5a4d8ac23053f7d40000000767a30cab8cbb3869a7e0c170a1829295eb25f553812df65a42cc3489773e3f5241a1c79437a637009cc334a48c0f06dd93b6216be733164cdc4b9db0d1e2693 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31D5BBE1-B887-11ED-ACDE-F2E58DC6BB35} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "384477607" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074b2d77a8e7a944ea7c282b9066208cc00000000020000000000106600000001000020000000f85c7f6a4dbf545ca90216656d099640f269af960c32794bf802adb1e4bdb5b5000000000e8000000002000020000000e854552e8e515abe0a2c92b5a35aca5899348a3f4bc7773015eba28cb869ce3520000000310b68d8389f4b3c869515c78104b69533b06268d8164a134445646412c46d7140000000b63e8680a30b2ff5bddd6053df26bcad0b5e008ca05cfcf4273a53f9a9a192f458a4ec11305ccccb1c58922b8cb813578ae3509a9769df9e765ecedeaed56bb7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 468 IEXPLORE.EXE 468 IEXPLORE.EXE 468 IEXPLORE.EXE 468 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 468 1992 iexplore.exe 29 PID 1992 wrote to memory of 468 1992 iexplore.exe 29 PID 1992 wrote to memory of 468 1992 iexplore.exe 29 PID 1992 wrote to memory of 468 1992 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5bc4ffcb4d5e05b6cbbc2e24a1f8fcf618f90d66aeae4e4a5c24961feb6dffe.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:468
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fc6d6808ae740634af67d0dda965ec7
SHA19010973744110fe6bee6f0ab09995739899684f2
SHA2562106802c47c1cb02dd3a693a9d4b94b0ff37091e3e5053aaf2712c814918771f
SHA5123ebaa44ac2395ee57754929cd04cd0640f2c5bf1eb26067704cf235556bd4ac132f944bfe5f450a86d82c74392126a0aefba7c38af5f2a8d04ac46c61595d95d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5884b4a9c6fa00dace9c532946584ad8c
SHA10a76c1e19f1c330f5b3d38f42d94dd51f8c6346b
SHA256bd883d6d0f556cbe9ee03324f133ca6f5b68c8cddc1ddf0d2a8d5bd725af5102
SHA51248a14cd278ee0ff9f4535fec72fca5784be3dedb8921959231c4510825ddc6051d76c60dbea1a922312e9d6df655b9793b6f708d541ddcb55267d1e44dcf76c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f26b2fceab0a3f2856a65a098123ad82
SHA1d52475ef94645c8962add6c7f1c9208ad466c3d2
SHA256a98dd2be985d3a7a5330e661058a033f1126843af3a8395a746eccdfd90aa15e
SHA512828a84abe21b9ff807a2191c9d4bd0d6cf2e33f3d838afd4bfacb5ad56326b0f78fc8f9dc1b979fa126d28effde7437cbdcaa2c83bd55f6566a75040421ae34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc417fac4d0849b9003925a417ffbac5
SHA1a075201716027eeddfdedfc8511119c3ad4b82f6
SHA2560facf37f4d828a2daea2bddced72094f23a25f0fd088d27868661bf6fe1d19a9
SHA512511b6a66284a48e7eac20a601d6288f11cc338be97688de4d060653ddc17ca084d33e3123e330e10c1d2ed18c5649af0e7513bbc07601542653dfdbe0cdf92bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8fc78e3b825db5d44c272156e158ea7
SHA1ab3fd871efceee3269667f3da1495de7d76bb652
SHA25696cd663a8128da2d71d0250049c6ba2101486b89d797c95db66f7c99b47ef4b5
SHA5120c29cffc05be7616dd14a4a7d729394893ff1c9ce07343fa52689d07c1b0ac7beb1ab960be95f66359968a3162b7a60ebf3bd5796717f96d9e200a4daad0f4a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5632714e2ca34e2f170e813e4c3720dd3
SHA11edca6a7d2d1d4a319c51b5af31476fc5fa03539
SHA25688c275d915837d64673139b255f16d5841badbd109c4e9d6c9440ed5e5c4cff9
SHA512a9c82b419b88881953722937ff430a3b619dcd8cbd8206a1cd6a5b183c5744ffaf9d7cffb69d9f7c64d40945185cd2e4ad787c6b80fe98431aa64ff64dff0a86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb374656443331e5c449d9a84b45198e
SHA19d7d636c1fff296dd7942adb1712b8f91cda9067
SHA256d556cff061c325da9fea33393ec49c29ce03d59db00e12b792223e9493fcaf93
SHA512f217b3bf0f71b3cbdc379d49fe3e332e23043ce93d88a3d17eba3d35b97c4a93e54b58ee246cf3719927b62b8ceedad9740127a9f502a14c3a50892d76d70ae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cf5895337c8a46ca28b658124a6a173
SHA1545153295b3d14ce760e7d6a7198728d73b3ae4d
SHA2565e2081c5dcbe26fb75aac7c52c3cf51d5abc50a95a758923fe64c214436ccc03
SHA51232d6358e3c083e193bdc8bc191f271e760149d8460c13a4cd5fe25fd54e46db96ca6630d4d60799cb3f5b3152e8dad6cdc3d137797d17630299018b2f8895864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab746d676102417f4861653bf5f01aca
SHA121739ce244d87e52f82f09df5f41a6e3632a785d
SHA256cbd2fc458a7554b8b557b92b1866fccf2fbda69c4c21a5569b33cb18f3f288ef
SHA512d059b0b9dedd7cf2f81924ce9b21069af4d23a81ea345caa73d19ab40a1f0ffd7cdb473eda282f3fc033176c1efd0a5a818743aa7d39a49e96946893ac5f3a9b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZTPJYNO\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
Filesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
603B
MD530eb40703a15c04c1067866c40c8f5b7
SHA147fe812491682eae8ec9067d21aed6756e387c19
SHA2560e00edaa001687fec5b15484954c362304d2e383dff58f664c2c9bd47c0ec758
SHA51244670115f30dfedfc47ff0e753ddb663a7ef6f0514d034bcfc9fddd994e974441014458c9ad33eb54b6abb809269924dceed83b8f67f0b9ecf28fd0bc491a10a