Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
anpfixmain.html
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
anpfixmain.html
Resource
win10v2004-20230703-en
General
-
Target
anpfixmain.html
-
Size
315B
-
MD5
a34ac19f4afae63adc5d2f7bc970c07f
-
SHA1
a82190fc530c265aa40a045c21770d967f4767b8
-
SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
-
SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7eaec47cb7afa4887efc5e3f3ae1d8c000000000200000000001066000000010000200000002ce2832f179464dde1b739e51a3b49df92dbbc63fab277f1ebed4d7c9ed41930000000000e80000000020000200000004f6d6c588cbd907384eb2fe3bcd6feaa1d2cb39c22cdaa03d9680d4d2877265190000000fb4adc0b0a3c1460ad2a4d3e1c22ee20ef4ac7d23cf85b28f2546e56d668abb02657ebf7045ccfba4f6f981339adea2afdf211d77c04262db09bbe60697fe22decbc62a432ed2e7b9b716e8e64f877e79d253933b6ec6a8537e9da09e4c7a114b92bf50cbd345c569234fdae873c96f9ad897ea332c4aa5b11a901bf25843af0bafb9d2ce45e28496002380d6af7084640000000fc152ff3d798b825cf82d6c37ad44cd1d949f22c17521b788ebbd399996700e76f8938bf0a443d8f5076d09fa33db403dfa95decd2d0ef24e14abcb959bcf624 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398967291" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c7eaec47cb7afa4887efc5e3f3ae1d8c000000000200000000001066000000010000200000003f1b0e33c695ac3e1f2de601f7289c8dce22895ee452f3aeb738a0931cc369bc000000000e80000000020000200000001a729874606f106c1c7fd9d35bd883a59b579ce0efc859063e4ceae6bfa33647200000005f6fc2c8155d5fad08288c1c377e91cbcae7cfa3a2a1cd4d8188ece52b56f33c4000000065c5bb00810e197ddb1e53014c9ffdf971d0fda0cca3c50059c64f6eaa0de4ed47196aa1469fd681c07c2c8d771cf9eae0c990f90b154e7a7c173e91d7a572e6 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e383abd8d5d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5D66461-41CB-11EE-B323-6E9AB37CAD16} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 832 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 832 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 832 iexplore.exe 832 iexplore.exe 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 832 wrote to memory of 2676 832 iexplore.exe 28 PID 832 wrote to memory of 2676 832 iexplore.exe 28 PID 832 wrote to memory of 2676 832 iexplore.exe 28 PID 832 wrote to memory of 2676 832 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\anpfixmain.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e56ec378251cd65923ad88c1e14d0b6e
SHA17f5d986e0a34dd81487f6439fb0446ffa52a712e
SHA25632ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0
SHA5122737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560a3941741639bc0afcc494b8ad988b1
SHA1971390d4c1e6e9a7bb6bbafe52549c5149d9b687
SHA2565af0a9c4b117635700bf4aa1d635e7b0b80a8b357c9ce3076c6e73e5b0413ce6
SHA512c190c0f2c17fe97b160c5059e62a3c473eda60678782e0eb5e7399065dce90114138bb7f63941440bc513d11d766010ba5a32d0a03597838a247807fd0b05b1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a6b1f52a861eb70be6967670b5c022a
SHA1922a00f1ef3235ce4b660b32392d489c69d7f8f1
SHA25624b57686b7d68208e03132b44e855d606384e4e226ebe7dea2515759a01f23c6
SHA512372aafdb340bf0b870bd4087e483e6743b9ddc1394e4a730acdaf944d33bda91fd92890954ca2a76957993e3a2c26c65c734e4dc1ae37dacf1b273ad7346ae74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e919b2bc84c0e94b4537e8beb31e5508
SHA15393d0cbcf83e93bb73d4a58f35aea265c7a078c
SHA256ea2687d37d3ef447bd1d659a4cc5a70e739e9dcd4c283f3814bcc296089b584d
SHA5129a51f551f61c53a2d92f3c02a1fb618f31ca6b765d989df827a20ad5d7718958bc9890b1b165a85119fca48dc6bb8b03b9680c084797d7e7df3db30fc5c28309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5943541c1399fb99402708419b0d4211d
SHA12fc317c135f2cf7be5e0e788e1a649ba55f5f16f
SHA256d4f647e9c90e6c57fa569db698454e844f38bdb754245aa4d9488d765f381cb7
SHA5121af4d2c343d335afe1f8e0992b3fb84caed70a4a39159fa93b3bd5e3942964960fd4aa1d55b6d4190d02ddb5f32e32afe5e9e2031c322e394239ea8d6b670380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a19cf57759f94aae82de63c3bb8fb1ff
SHA18f5de727f95c1551481d5a4bbe91fd17401c1035
SHA256ea7c9bece66485384a3fd3df229b47ecb5510de428b05cd11f46f8c0953c3f0e
SHA512241aacfd53b0c29f2428998bd1ec403a6a236dc013160facd2d0f33886e3c1313967c696589015a6327c290024983646f6f459f6a0665ceec54f033f56886321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552c1b42d6de5caa11a234d5a92cdcec1
SHA10834c783ef631244f9228a084e8401fd5f9ba9ea
SHA256160f3b52c5bf423468bf0a8a1293a626d53d1c9aaa4533d21a8aca9cc0eaf428
SHA512925c6fbe789348a34ff32d5035ac84dc41ba77c47206a24986fcb49a058feac628edc6126be930af01ae60429b2e977d3c61a9b38263f06f5db7256fd3a0c1ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e3f19daceaa9d14023ed635297749b8
SHA1edb993ca6c10edd07fe0631995a8446e144a962f
SHA25663d7ef089d9a2c36301a4b95d9cbefe50e52fd1f4f15c6be097c6776825bbf20
SHA5121002c41b48532408ffc12e52cb4b5feff1f81990f71763645c68a11aaad8ddd2dce1f5649bd2061c98ad6b9f82f8ce34b59acb47c1e9db2ab80a43f27ce401eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554309f05e4bfea564dbbcc3a59cbdb8d
SHA1bea3f4ac79b98ea2ed7a8654d1fd9ae47bd62ba1
SHA256bd21401c35c8260f5398f732e68ee4f1e04c22de9da0e6f84c82db3c312ccd51
SHA51205fe0704ed5db70bac8a811860ae772b9d432302b9a10f9622d4a6803001da420ef9b1ba54b0581e1f0bb70a7b85fe54ed076d0e5cbf2e793ea795df3024f2c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f6a4ae9f07be7837f52ebd7ddebb317
SHA16115654497ae416a56ab26f238208e9c34a74771
SHA256aae97a8c2c5f7796c7bfde1861764d3ff3a669e087d032ea0454621301178739
SHA51244a0fd1729e603e195d04e635faf6ea177cc0c778d160749bdc18487eab821013669faf99dfbd809f6bda341bd7e86721eed88b43d4c8ea6a0a204bafdf4f0e9
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
163KB
MD519399ab248018076e27957e772bcfbab
SHA1faef897e02d9501146beb49f75da1caf12967b88
SHA256326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9
SHA5126d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103