Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02/05/2023, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
Report004387684373278322023.htm
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Report004387684373278322023.htm
Resource
win10v2004-20230221-en
General
-
Target
Report004387684373278322023.htm
-
Size
1KB
-
MD5
aaab5260a1d850080bce6e01dcaf8388
-
SHA1
f640914743578ee16fe16d642892a85985d6d599
-
SHA256
077177269b25ae9c1a4d9d02de7af592c16998f85fec2677abf4580555016146
-
SHA512
73c9c9bac8e005159692eab1dc074eb0823270cee2a29c302563947d6f82cc18f4e3de70fc05467e3e37399e6a9542fe296b57ffbc01a4ff7ae35ce25bbbf142
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "389817331" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000bde066bec81e5436ef156027aca607c1da78df480316832db63439aa38066642000000000e8000000002000020000000afc2c3e64096d0d03ed398ab8e6896975ac78d424a06e8852e2c72dda51876e520000000a1eb4cc039cd18a94c350737adb89c16c54bff8fd9b974c3e2903c02dd2354cd400000008bbc899df560de8b537ea95d1edbd6027f9fcb8452621456e67754f8efbf1a7dda97d912ee8114853350d2326da5a96d7bbfc4eb40fb9902cf3ae3d556631017 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bf6292247dd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5EB74E1-E917-11ED-B9F1-F221FC82CB7E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000778c0aa9dd5371b3feaad1a9f34f60207d06cbdb9f7e48886c952c5e07dd122c000000000e8000000002000020000000b89eb7e45527f6547d3ab8ef3e310012c06e9a9df05444c83af68955ef522bed90000000078b7cb47fa9f5b5166c5410bbfa83089c73e770ad5db519aab4254d918d0324ba46bcaf6de99dbbba65532c1d4d1a15b66335fba6703f6babe94017cda42224793f2e3dffc741843b2695815acd9bd2d53a8cacc923a2e44eee9d5154563f26623868f4c3fccb684d70746405fb03fca62eeeb9d1cb2d715c3ac4ed2c58ad76eea2a96f38e2561b306c13fa6d5dc58840000000474961298e9015becab1615f7f9ea3f35ffeef21f09a3f53064103fda6d9734ee3d65c0ef85cf9d61fdc5f0d04c977133037f146382977e6fbecde1d5637a10f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 iexplore.exe 1708 iexplore.exe 368 IEXPLORE.EXE 368 IEXPLORE.EXE 368 IEXPLORE.EXE 368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 368 1708 iexplore.exe 29 PID 1708 wrote to memory of 368 1708 iexplore.exe 29 PID 1708 wrote to memory of 368 1708 iexplore.exe 29 PID 1708 wrote to memory of 368 1708 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Report004387684373278322023.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:368
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5308b11635d8fd8daf81194d88146df71
SHA1b32197896373d80ca08d3808c04639ad4a1025f7
SHA256620d25279e6744031466112020bb9581d9cb897f20a36c8d80ef0499a9b137b3
SHA5125b4ef45b706a727e5028d89559e2a2e4fe4ce47adde1d825c9a7fa79ee75a290a7a930f3e5541b056e473fb7b7e30180151f1e5b451ccb449c09468a139778ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed3776bd6e58568d704205d17ec30a73
SHA13fb29af00ecf865ba3b4d7456dbd810fcd0a38ab
SHA256a3d913ea991f036037fa6b5dca6007b2103ef3f23398674bcac976b9f9db2b9a
SHA5122cc3c7baf72c7116a62c3fb32aeacf4214a6d83ccea4fd37bd1aed9ad8c1c7de880e15e43e8fc744f13074a5ff164a136652236cfdf2b23746899d10da2cb496
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3bc65f2bfbc7bdff71e3d6063990874
SHA1d0120c0512b536217a8871dd954e6bc4ad06e2f4
SHA256c25e2fbc25696682cd0c174a5b15adf0af2ef1f6d23953f13d8baeaa9f06a011
SHA512dc86a234b76786a63546476ad491897f6df46e87feaa3a75f780eccf31cb905c826beaea26c9f396a0cd2381279d7f68eabd014217ee1d7aaa3b65b4a8532db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abba71bf3892a91c977c40131b0da95a
SHA172cd716b0109c68a7eff6e7499fe94a9ca2a3895
SHA2568b0c7e6cfc2c21ee2070d5900142096f7585904f8005c8dae4778cae9bf789d9
SHA512bc7e7a1cb26caf8a298c17e49b3f35aeef0548086bde7d5980be0245aa71c0f5e30a5c8ee76f1064f0e31e2fe24d10692ece2a3c105b1e231fc9d2e2114517fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fd7025467ef212a31585c76598db1aa
SHA159e91835b3d98a6405323d29fdd8a88c3bf2a8cb
SHA2565d4d8381f74b87c1d1280e3018ce013a53160d54050b31baf198bc55a869b791
SHA51250291cc68a386c4d5afeb41843f2d8cf790cd549f00792dfda133ef03c0ee12b0abbe8793b4dc4b3b25b133cd3a7e56e6981692daa2d1ad4b64a21fec4b7eefd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522881c6a7c51e32bbc522b7e0d29e9fe
SHA1efbae69720ef1fc9aa4fe14f89fee1ca0c322a67
SHA256b0448a1e25a4862ee138470739026472b8a69cf5e4be14bfd1e956b8b39f3c4f
SHA512abe5f06d83d108f5216b251fce81b342846176a909a0a6c04570d9a0ff565d9866aba24b92196cbae8941d7a958a08ea43be6ce731348ae18d4cd9a8fcf44c49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5369dec52964ab55a34687e65c53bb5c7
SHA1139573f36df78f57acf0674c6fbb803dba67d0a8
SHA256df3301ef38dba30b14d699052e88dcc6c8f6a3f519a96e23312cbad7e72e2506
SHA512c70f09280d71b6d90accbcdf7cd0a1acb71fd078f3aedc185ac62061278d2f63a20adfb54c8d3027ce6890a5d61252436f9cf2d624abfe4cde3bf878d6d1fd95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583d3f4c659d872af4d9a2d0886fdf11c
SHA1295315569f67789ddf92e765594e692e23764d50
SHA25666f7aef5f3687f4dca0a24f6d3a29a2ef29aa8954de31a2c1fac625730bb7768
SHA5129619b3ce702ec0768bbcef12508027396934b81a30f820b6e6627a6af0830fd974e7c7e45563a0094c1b5ba16850a901c101c8eb7f30c1702dbe885e3fc478c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5005e7d511cf192b1f061666b368e2f70
SHA150d34802325f8775a84cf2c30547ce13d753c1ab
SHA2568a76fe2076ab402565cd75a413a0264827cfc9e5024cc84c6e31977c1bda5ca5
SHA512a2a10c1001634bede3fd5bc11af015202b5530769a3b9bbeca685c4656673a16611f956c3a14ff49a9e329603574c35e2f7d2e967b10f6a6fb5bd18d08c8c0a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ec55e53198c0945e30170a6268f0e1f
SHA14a63012f3883c03cda6143a2f8c52acdbd6a7781
SHA256cf4c94c7927eac27333f2190ea20102f9f54c64f879cd1a0501497583aeda9a6
SHA51295025f75afc8e4fdf7e5b8bdafa8f86f30caadbce98c2cce08b51881432e48dd9524b1ba4d270a4556e57053df3a04382a3cf7203ff37a7594d7ef9432a12d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590b58ef8a5faf92e5fafbf2fda78ef74
SHA1c5a876836f2ed7ba33a05a50da5f556dbbb8d375
SHA256fdd3b15741438f4d00790bbef47345426d47e20f8c73349a95611a8202c0fbe6
SHA51224581e20a0de113e3127ef23e1584aeb27b32faa8137ce2f5e7da1f94ec36b14d3f180fbedae68c949ec72027806659fcc784d72bdb0c1500ae3f452a72f7326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a86c8c4f9250e52d98f97ee005a8e470
SHA17a6eeb2f60f11f5f15439679dd38883bb95dfbd2
SHA256091c119872bbc0a806ff8f79716c4b079b6e4d93f23db0825345b218b17f7a98
SHA512476ff4658064c8fd5da1f9b8f8c53063097b69bad06245e6d1e3bd49720ab41aaf7ec402080ee1926de800bae1fcc467fe8912e336561912d1d69a631354c064
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
600B
MD549686cf28995078a4d8508276c10ea46
SHA18afc6e65e9ccf6d737de423d0666b03032912ca1
SHA2566221d69a5317949020e16f5b74f04caf8968a90f4e36ba276295dd8420ecf464
SHA512aa2cf30278fd998aefdf8b560d5a292c0061319a6940cbc61ab88e15a8c80d5575f06b91c118c06f57e23efd90e152bebcb81d2f3028c08e47a220585017014e