Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231023-de -
resource tags
arch:x64arch:x86image:win7-20231023-delocale:de-deos:windows7-x64systemwindows -
submitted
26/11/2023, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
45e027e5-1183-4601-b7fc-913399630134.html
Resource
win7-20231023-de
Behavioral task
behavioral2
Sample
45e027e5-1183-4601-b7fc-913399630134.html
Resource
win10v2004-20231020-de
General
-
Target
45e027e5-1183-4601-b7fc-913399630134.html
-
Size
315B
-
MD5
a34ac19f4afae63adc5d2f7bc970c07f
-
SHA1
a82190fc530c265aa40a045c21770d967f4767b8
-
SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
-
SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000009a3d81ae11b481cef3382fce7dd7cb60796887990081ee2d8f544033a66afb92000000000e8000000002000020000000bd7d4ede22e58b223604437d40598f521a3e951992d97c22aa7aeaf3f897899120000000c28ddb8ddaa9e2124b3be083d2456cec8f7397b40447f75bc6f7641786438690400000001624663a10f4dc50a6657c21a34ce76f885b0fd0b01771a2ec0e79e3d8d39e9e1834f0a13048da569f9ecac96b639d20e873a247169eb53f8f14c5de1859e539 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f8ecd73820da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{030428F1-8C2C-11EE-B522-D6DAF8237762} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000629766d3e8408fba1b3be47f9b6a3091c24aa3260d5c7b52038175ecf54abed0000000000e8000000002000020000000448570cb542c2b97d88895a994f75006ab525a7b26d337f1c02c76984e9a20a290000000b2ffa345da96b979e76dbc3c4b098a63f7b0dea6d4e2fef44839d9490dfc19b1c8f4802e6cb4b32702199bca36795757bb8924482b00f6f43fb1012fc732faf95da325c125ae688be6b051db0857dd37c5d21de2f24d796f997de8bbc80bcd28774552bab3f65d7546d346284427ecbdc0fb19ba25e31427ce4c8f4caab02007dbbda6fd8c30b8e3e0573a5518f9e9ad400000003ca089a50a6725aa87d67fca42316484e06817b13985452b9b8f8e33d2a19ecc4a10fb5b01272d92c5ebffa57f64800f7a70c8a416e0d674d707ebdf9e15581f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407144983" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2864 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2864 iexplore.exe 2864 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2448 2864 iexplore.exe 28 PID 2864 wrote to memory of 2448 2864 iexplore.exe 28 PID 2864 wrote to memory of 2448 2864 iexplore.exe 28 PID 2864 wrote to memory of 2448 2864 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45e027e5-1183-4601-b7fc-913399630134.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4e57c877fc29d3ae92b5d867ce867c4
SHA1a3068a9fa8cfb9245f76164a51ac7ae51fadbbc0
SHA256c4ebd01870fe8643f122a447785415406f55c7fcf5d6b83e73049957c49f784a
SHA512cf7a1af99a3171c2f572b3ee531fbc6b884f1e0a7cbcda9e7577bc67fbb7a960a71035fbf310add1aef3c14c042947774cd52ec56e244e612fe7c84d298c826a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52affcac7f714d2e59dbb7f8648827aa3
SHA10c373ed416f5abfd34e455d145deaacbd68d38ec
SHA256cefd063780f07094d66744495a3c11b1575f4a5a5e1fcbe06ea614f861322e49
SHA512852543f79fbb46696acabb5afd00d99c9b684b6488a513e6564b64f29087dd6ef204c9f4634c7e4c1b9a9108a658d5586195d69a045af175ef01a3909ab08942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b91b20e894b49728e0ea53ca5c90685
SHA131a3b90d0f619bbf374935afbd1d22266bdd18b2
SHA2568b2a00ee1962006f960ba789e586fbf6519d0472df0ee70671e4c6f7eef2be33
SHA512797dbe51e404ded654a0d22ab7b1cdbcd1d1ada4ff90b87d54ed50a02ef2aae50bb81c967c3778dc8286d04176afb989f6eeb4d14cc8c3878fe6a7bad40551c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508b8e82d7c1291232d019a9d70257fcc
SHA195b9268ab3fb93ccba6f2547b96ef06d0819dbba
SHA256c9e0db57e3bb65efdbb585cee97157e5ebf1935adcd208736821546056eeca61
SHA512f86672e7b3f5ac2b249a065833f648a46baf717c08b239112b218080f3d0571a9e5286715323fe839b267043f0fb320b81f5c0fd80b012a487906c718b7a96fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50085724ea7c6915833dc090e6b04851c
SHA1db4c497048b366f9bbefe3de691cf7e737a41c45
SHA256004702da117a9a8270c576d2ce0378433c7a3da03da2ffb4bf3831c861f6f67e
SHA512046165e615aa1087fd878e84ab0050ce143bc07535e32b7ecd4d2c8d90e4beefdc706084721485d2c945980b54764bdf3fe5ced26988ce24bb3ea8f063036a43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514e6372b6721e8fde27d84b35e51fd9d
SHA1c7c409d7ccb8a3549eda782e7eb4d95fa78b049b
SHA256989f313456591d7034909f49cd34cbb0eeb308802104d985103a4d0f8fadd738
SHA5126001e66aaed99491b08c35a94f09cefac0e2b8b71f3752338a877805d43e55dd2928567f7948e10bb4bd0fc5b67b819b910b92faabe84fe80854b7dfdc695ecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5071995bc2182094274b320fc36ccf99c
SHA1ca60a121b6f25238f427477af1d993988d68fa02
SHA256ec217eb29a4f9aae833412a532a2bedff6a6cdd555521937418727b6ea3737f9
SHA512f0447a3b3778f2bf8b168fb9ef7f39d401071bda1f97bc78fa93dd80b12993aa81a440607e5e31dba4ecf05ddbdce8d157429ad60441fc7be9c044a8b5a7e981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afc512e4522624a425cf85af3b1f6c98
SHA107b053104da5b7ee3271fe4c7a205471b9f0f35d
SHA25665a126c6cf16d604d41c601d396bf3aec2c2f9ce969fe9f365ec4a2cf71e6695
SHA512aa39ca861cc256dfe6bcfd262b86d4de66f3d37cd1a9f05196cbdb21304ae46ef4658b94d08d2ffbbdb8307091d46591cb6c526cb9d5fa6eaee8ac4f14fb8ff3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f6ececb7920ac394963a68e38686a09
SHA13158592913214f7c06f21157dd49c0e521e56ff8
SHA25688e664417301676642e5338cf3e964683269ab7c3fc008ca4eb3b4e207c79805
SHA5121126cb5f55ed0c6c098ffa87b85aabaa5d1c15fed4038f851dc607e214243a9e12880ecbf70cc26b70f722d138f2c51c27551cc499ed4f44c054d2c996ba8375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e61dca46faaf72f4d6af584657dfef30
SHA1ae3a87905a9f7dde09e7984c1ade177b2b9f6922
SHA256872f780f1fe823fdc9358de90561a5817b45fdd0f7974749091e588001e4c9f1
SHA512beed59349851363ac3372b892b109f4f85ecebf30c61de56a4d27f714d4d06a0bae98052b31ddb64e17b11831168b382b669ab6460a0721422d80ea50bdb256c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e1bd9331eaaf5141e40b09f182498ac
SHA1a1ee153930aabe2a0f5c9fe8f4441c34108cfec6
SHA256126da9ca59c6fe8a8264a235a46681b928b745f5ade985caab3f1b28194baed1
SHA51211abf4b68ad6a4bf5ca01f9ca0191fb60803a9d0140851078b489382d78ab0de55d003f4494b1cb20182aa3477c19d247b3f74a8ccddaf4d19c7779f76e2aa37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56906ebb59955d6d01a75a9c2c5868186
SHA141d25c87d4dfe32ce4a828da2d33135bafcd1003
SHA25677f7c6350aee54ab217d0e5c1348ec940b578fe627ec3f167cdf81e11ee06609
SHA51260d9fce8b538699bba9a29fb8a960bbd1306226dcc662b2cc867be92589771dc1aa7945b8ae6c21c2c5661203822daf33a393711db44bec6ec49289f3039a6b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5909606365f89f611073ce2d6304fce61
SHA18e748ecf999e4f6b0455f9a78e7b2be58e2bda0c
SHA256f871e6d343fd31e52403115885b9405cc0e08fe8e88ec8f36c817bcbdd9f43ec
SHA5121ce52743e3559aadf14c24fc94ee5e6d8ccd8e1ac2980c973380450143ed3710acc6558edd5ff4b18401d8e26d0f9986348c8f330cb982f7266e2ff26ed4b82c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f81a1ebde88df0ac499a68ef8966df8d
SHA11d5fa5b21184cda45a5533b0ae3a1b9b6e5e98c0
SHA2565ecd4bbf984053ccc0062e5411b1020688101b5fa2fc69328844163a99fd2ee4
SHA51285447595aa63fa64a3b746863cc90ceb0d76f9a0583ef70635bda850a7f4c6569d2d25f7a57349d61bcfb7192a30e0f8b0c0240bc905fde599676162b6d25a2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ebbf5f7b7cec9b9e1048c25334b2db1
SHA1efb748aeb5d39550bdd9421af398a516e41456be
SHA2560bea1b288ea1e48c3b722da2efd9d7b707b49ef276a2f7ed63bc1a2ac67987e2
SHA5129435509b32daf9565e6fb42a1c9970a975cc0db90e608bafc64025c32f705f7c18a32fa5efa986f370149e536bac2dcbc589268b056ab0f581c1e9daeb97a205
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aa8890aad07ebe7f2bd208bed203b77
SHA141e20e82351c7ea93355ff698bb17bd6b837165e
SHA256545d250e1933218132616272f2d0285278647778dab3715c175bf5adcae5aebe
SHA512aefc449ddad16d84ff14a92d9f94583bff5a93d9b4d3b9388e1e8deec43f06300fc217b8c77b42fff3f26044d1486eab28c7064ff288dcc2b162ac65fc19151d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595c01fe90314da47dea3c039fc61f285
SHA1553c051eb905583fd835d1ef058537143b22adf0
SHA256862c03d60e46632ec9e212f80e8222b07c93e4187af6e3ee67a529959212444d
SHA51269a6ac048054b91d96ab25d4a047c4e1e9b69d34557b7845a81c5d41634c1bcc66f6096d4258faf9b20a77bdc2cbaab9118550d04d86ef229d968edf72902507
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf