Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7GB_b19741fxj.apk
android-9-x86
1YOWA.html
windows7-x64
1YOWA.html
windows10-2004-x64
1changelog-ar.html
windows7-x64
1changelog-ar.html
windows10-2004-x64
1changelog.html
windows7-x64
1changelog.html
windows10-2004-x64
1clockDarkTheme.xml
windows7-x64
1clockDarkTheme.xml
windows10-2004-x64
1clockLightTheme.xml
windows7-x64
1clockLightTheme.xml
windows10-2004-x64
1credits.html
windows7-x64
1credits.html
windows10-2004-x64
1e0012.png
windows7-x64
3e0012.png
windows10-2004-x64
3e0231.png
windows7-x64
3e0231.png
windows10-2004-x64
3e0537.png
windows7-x64
3e0537.png
windows10-2004-x64
3e1296.obi
windows7-x64
3e1296.obi
windows10-2004-x64
5e1299.png
windows7-x64
3e1299.png
windows10-2004-x64
3e1300.png
windows7-x64
3e1300.png
windows10-2004-x64
3e1302.png
windows7-x64
3e1302.png
windows10-2004-x64
3e1439.png
windows7-x64
3e1439.png
windows10-2004-x64
3e1440.png
windows7-x64
3e1440.png
windows10-2004-x64
3e1441.obi
windows7-x64
3Resubmissions
06/07/2023, 18:35
230706-w8fqlsdg43 706/07/2023, 18:32
230706-w6mfdadg35 706/07/2023, 18:27
230706-w34kgsdg32 705/07/2023, 09:21
230705-lbqjfabd66 705/07/2023, 08:59
230705-kxxdfach7v 705/07/2023, 08:41
230705-klwmrscg9y 705/07/2023, 07:15
230705-h3aqhscf6z 705/07/2023, 07:13
230705-h2e9lsba95 705/07/2023, 06:50
230705-hl6fvscf2t 7Analysis
-
max time kernel
100s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
05/07/2023, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
GB_b19741fxj.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
YOWA.html
Resource
win7-20230703-en
Behavioral task
behavioral3
Sample
YOWA.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
changelog-ar.html
Resource
win7-20230621-en
Behavioral task
behavioral5
Sample
changelog-ar.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
changelog.html
Resource
win7-20230703-en
Behavioral task
behavioral7
Sample
changelog.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
clockDarkTheme.xml
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
clockDarkTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
clockLightTheme.xml
Resource
win7-20230703-en
Behavioral task
behavioral11
Sample
clockLightTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
credits.html
Resource
win7-20230621-en
Behavioral task
behavioral13
Sample
credits.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
e0012.png
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
e0012.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
e0231.png
Resource
win7-20230703-en
Behavioral task
behavioral17
Sample
e0231.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
e0537.png
Resource
win7-20230703-en
Behavioral task
behavioral19
Sample
e0537.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
e1296.obi
Resource
win7-20230621-en
Behavioral task
behavioral21
Sample
e1296.obi
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
e1299.png
Resource
win7-20230703-en
Behavioral task
behavioral23
Sample
e1299.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
e1300.png
Resource
win7-20230703-en
Behavioral task
behavioral25
Sample
e1300.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
e1302.png
Resource
win7-20230703-en
Behavioral task
behavioral27
Sample
e1302.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
e1439.png
Resource
win7-20230703-en
Behavioral task
behavioral29
Sample
e1439.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
e1440.png
Resource
win7-20230703-en
Behavioral task
behavioral31
Sample
e1440.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
e1441.obi
Resource
win7-20230703-en
General
-
Target
changelog.html
-
Size
74KB
-
MD5
de665303b7be08ecf0864e311e94a494
-
SHA1
24a439da462073f0bad6cb46fbb563d1853c6eb8
-
SHA256
96b893c1582a878bc721d0a19229e7bc99aaaae107002c651d57fd5bf5bdf9b7
-
SHA512
102893fd6dc7dc340cfd453619b281f5b6db285847d76058ca6ca2db829d9080e46c965eaeb0ff5db63adf1501a2fc8bc8490af31b6eb16afe7495cec22b456a
-
SSDEEP
1536:6eTlYbDk68dvzfMBBx+N24Dt2XGyjdwa8cID20+ADN6z+yH0ZyQmbvfZ/4OAS9vr:nTEDk68dreB0N24DsXGSwaZIDH+ADN6P
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395304887" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BCCCD31-1B00-11EE-8726-5653D379D7D0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cacdb9c8f7e7d1478a5f6d5a6cb4c2900000000002000000000010660000000100002000000059e47e2e7eaa2c047fc8e930e083e4f32eec178ea1754d2af2801cee8d41db1e000000000e80000000020000200000007b27704a2e9c12b73569e4dcc4265e332f20991c5924970a197c53ae079e100f20000000a59a48ec466456b4d68f812e75cd1129181caa22d7e47c9c8e7e561f7ce9c8144000000060b8529d6be8ab071e72a5585c443b5a6af4743c4c2692667b3428f9578ce7e2d62f32e19ce0f1e1f244b162cf4ff3045a6aacfccccf26689ab875db035241e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c5e8410dafd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cacdb9c8f7e7d1478a5f6d5a6cb4c290000000000200000000001066000000010000200000000dca598cfe890769450cb3c2fa9ebd7e43e52e688e1ca5d3eb3896ce519b1256000000000e8000000002000020000000b7b34e146d4c0644ae4b1d5fd86da3b8bba3cf0ddb3f3969dce6a8cb75d2a4219000000007b67c77712bec569250e21e5561bb01e491aebe5be461114488d956edc22aac9b53d3a89c46d3f534c2501ad0b2a86d5e25634f299cc423de39653aa9e4dafa86052507a573de24796080158052d67d28e1985c66a323cb66c0a0e119013508ac1fb6e04e41f78e459417cdcc4cbf2327f188e4ad375e6c43c14197ca689e45e146d2406d16f30f84042b5f2aecc6d4400000006d26b294580b74b7a52a1ce7cc8dce784079baffc6dd4056291024bd8d420a29ee99e839098e51a3d2acf96bddbae668389b786a8e056e566b80768c1ef7bbac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3060 iexplore.exe 3060 iexplore.exe 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3060 wrote to memory of 1748 3060 iexplore.exe 29 PID 3060 wrote to memory of 1748 3060 iexplore.exe 29 PID 3060 wrote to memory of 1748 3060 iexplore.exe 29 PID 3060 wrote to memory of 1748 3060 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\changelog.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e442bd04ca2b5a0fd89e8eda77c3260c
SHA173cea788539c61bad267863752c9ae763183083e
SHA256e72300b776b0925d5a75428ee0591f90e77f65943cbfe13b337c18ffe242f24a
SHA51273ed069aa238065fa66c7031b09fc93c59098946661c981b6e680cb6aace523c798dc8d3bfd868fcbbc047ff01f60629c8739de064b53356c3a99a5845b3e33b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8671f0457d0cdc1722fada368aa0bac
SHA13320579202086e89e80b9c9555f01d383f1f6b85
SHA25677287fa5c19f531a757016fa573c2e4f01b085c9ff0c006c79dd66dbb4cece59
SHA51232e79bf86dbb3be56dea289732133d0ee7a346b3c24aacd6442f911003f5efe21cbf852956b37dff7a1e162c31aee564a9ffa22dc5c2915611aa4509e637a6cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5117bb2367ec70472c9f3a655e5c9e85f
SHA19bec9233dde87cf360c1b09d7ea4f4265af2d1e4
SHA256a54c775be47c1af4608abbd01ebf4b8ac4d80fb5e4725853b8e45f9650db66b1
SHA512fd06c7f128b64a8ebb7ab969fb56513bd62d14b7954a54cc1c50f5ff8279326293e0f24aed83551c723e9444b47bd85ae6859446f37bfa5b6a964d0c1a790373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5003a796ea00952f494b1d375ce10078d
SHA152220415a650e379bd7b499f87f731a8cbbaa62c
SHA256418dd92ee145000ff841cc45704262dfee93925103f4c820147443ee057e24f0
SHA512f1796147474b5e30fc913d499b02492baedffe11d3f3af559e1fddb214510417483fd7261e499384fe5e4319893a52926ed7c5e4296f0ca207504538d7caa595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57edcef0c3e7a5b32956f2acb688b676f
SHA1e7577b0ab4af13fe45f95e7ded765a96f38556ea
SHA2564537cfaef33ce1346495bb70875b9ba32fd9da7363129b423d7ec26845067ded
SHA512c883cf10f9832f4952c6fc7f045a0adb04d5def3ed25b755aab935252bb96e0285e3728404c2d0f719580b06369fc50f110abf4a8245e2b1dfe11c7da7c9d69f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52657d05a3081d971437c3e15f1a98577
SHA1e661a0f084afbe62ea8499022a324e9dce4c1407
SHA256324167c34320985771ebf804458a6adfa359129f334502d5a570005314bc819b
SHA512ae3e1f916ba2c682fc28893a29811e65fd69263a5963b976be3d159b50644a4cd3f42a05ad0130d41f924e81290d12ef7c5b84f212f43a6b2f0767506316d7e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb007d88481877dad7a8fbf164d2ecb7
SHA1499b38611043c7a7f04c190caa5e53171422c236
SHA256d76287e84d31021a2874bb41149f321fc1002f327a31df133c7b535e61062ec1
SHA512cb3ad4a7a6e085ccbebe66183d21166ee25791270a1f5a403ec060b6ff93164bbb9dd2c1b0cb941da1eac8d0903c84a9475bceb8e70c1aca3d1c91cc58bbc486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d41490a5456389736bafceca1def85e8
SHA17e09de00af0b35038b72c32efc15d97fd629ed5c
SHA256fb870433ee698c818c034254d130cd05fccc66cce71b2a38f4eef2ed55c15e16
SHA512043beee5270c2e52065e70e3870e5bada8d81b8831e30229489ee6a41381a159dd6a2bcc4354b30e18b2132ff440039596fcce3b61a005703888cd3a891842e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd7977243b17174f86a1d9c69a462e0e
SHA1d06563aa04b4882fe24c194119192ccf54a60181
SHA256eb822ed80dd16968248e1294cfdd6e55d0dc6da91adeee53051f12842653105a
SHA51284c97120f97da5668a020be34c5aaf0c9e83132b34ab17342acff45263fb3ecc3975fc2e2dce18f47456f47d17f6d3122c59d54edb04f238c72d3555afee0ecb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S593MPCP\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
608B
MD5bdea1eb1f1faa19289f705d5822c6cd6
SHA1f8d37469f1329a2f6ced3bef6367deb5929146fd
SHA2567bd4aa78bef49da4155921c1b8ab178fdcfedd6262f05df845f9fb974501ef50
SHA5124eb5bee4d413ecd1da7f567d247818ca3c01a52551248ca58d103213c1edcbceed0ac386cdcb289e4da594ba1b32c9d82b2b46d993b0a0b61d8b26edcba0ed2f