Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
2ca6b48b629f3858925da3bd86f8d920.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2ca6b48b629f3858925da3bd86f8d920.html
Resource
win10v2004-20231215-en
General
-
Target
2ca6b48b629f3858925da3bd86f8d920.html
-
Size
430B
-
MD5
2ca6b48b629f3858925da3bd86f8d920
-
SHA1
7aa48a7aae84d7ca3e424ecb27934b72729f3176
-
SHA256
4c0b935c84f82ca494a6fe7ef34491ee7dbaff5aea323a3e7d3c31b9c3d2561e
-
SHA512
c01fd36c977e2ad71f91135b7c5d294e571457418afb100d556c56f3cf1292248ff75fc5e4137440b48188575a3ed17c87d0a4d7e326d82c5e026af25bf3830d
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008a3b8be0f2448bf97f3151f5f33803b4e5ac7ea4b7815b84b4052213fce3ec2e000000000e80000000020000200000003d58ffd675960051267ca115d72e31a3fd7a1eb452c4745139737d021b7163d020000000c4ee1ba517fe7734207452bed5bf6ee9911dfbb4bb12fd65b4734fcc33b9abb4400000001a66d8456c2405f3c04ac3ccc6d0917844d5b7a749373fe4b387aa468508492de243e0a81b390b6143e5b77b15e618d93fb50b90a5b9329a46be017843e49e6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000f664640bf46d110c18fbb82bc0dfc8745acd0eb07f12430fbdcab510d363a95c000000000e800000000200002000000039d439f0aba4aabbb4aaf6984b4beb6f2e614cc702c787e7b3104c1b1cd4fddb90000000fe12d9422c63b4ef7b76dbc81bf323707358f2dedf01825104ed311e1d8b4b69579644db8cd0b6e23855d81e22076385049475471f169942f6ea527a9dc518475dc458c51aeedb8db489fc85e001a318e916c9adf464a6ad9cef0ca8ce040db31088acd2b952bab296b75da77958e1ce479e2dc86bdcc8f682c0e5f06a5f54aeb63453e239ae14a8b3b831392308b0954000000047a414063e3e8cd4bcb957e1fe6cdcc22e36485f20137aa8a691a6562e5b999c6f1d200f8b04a7d03153952f4d1ced905922b22e903ba321d35de4b938409a31 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410359081" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AC11361-A967-11EE-8459-F62A48C4CCA6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e6bb38743dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3064 2988 iexplore.exe 16 PID 2988 wrote to memory of 3064 2988 iexplore.exe 16 PID 2988 wrote to memory of 3064 2988 iexplore.exe 16 PID 2988 wrote to memory of 3064 2988 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ca6b48b629f3858925da3bd86f8d920.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5974c540792aa268081b3135fb07c465b
SHA19c8d747fe818e993dba8023e8d88a20e9fc273b9
SHA256c69c771b3878accfa42cc7e3ae7ede9d9c6e97e16c748f5df74ffd5c6001c6f7
SHA51227aa98322a51236abd2a35c9495cf2a77421b98d245badb4a1d01d44844491ecfc409e1950f083b379b288bd07920cd70f50f0f2da01d0ab061d417d40a48562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526818676ca7b5bfa50aa716392a006ce
SHA19a0c2d431f1ce5107c79934d468dfdbe24c27aee
SHA256248579f9fc46b6b82a9edec7b93cdca2d78fc955c0d74d62bcd94fbcd7c96ae7
SHA5124a015da7bf9a330d7d9e54e186f41910c8d007a516ed23c430ff74888e72a8ef12717ed844ad9fd5d0a67d1b2d16dc2bd2317fc24a3927469951bfc4b64146cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58450f85c76ab8144cb6bdbeb42bb3bff
SHA188cbbca13be4405ec2f322c9da808e7827da7368
SHA256d7f384dd0d3142f919fc52476bdb123f3a6143c762207d4f372792f928b5cfdd
SHA51242a4c7ae2eaa436cf528d5905bcc8fa6185bd3047c9e27878191da1eca9a62fe8778a0e599f3ca4fe4fcb95982ea5cbf2f4fd4d44c8ae45b0702e3fe00da59ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533bbea62c8d9dd40670c48872521e823
SHA1abfdf715a23b313b1c6606c1e4aea851657a8acd
SHA2560c1221bc2dd918745b91e0f0db08dfe7ebefc8b268f2b3d40a693044898a3610
SHA512f9636e4e83eaf92c758e9eada7585be45ad04e52faaf84d9607f9e4e1bd8138e63a4a7f07fed1cbb18d5a7d6f33321f25c0dac2641a4bc516c1a3ce58ff7bef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545ced3293b3c68c730c15a0ce63dab84
SHA13682df8bbab41a524f40f46079a60246af6b3f5f
SHA256f45cde402bd6beafe4a97f8f90d867227873606f37a3f97b9cda79d63b890b5b
SHA512f4b2d67093914fdd66f97ae5716c17a84c435e63ab4c3402995d0b96f75f6a2f6cae18492b806464d009a2baa4340c87c8824449c2999be411027dfc6ba6ccfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a78652039a1d721919e58db599d6db9
SHA1d3d2735de3d1ad7e59321419cd7feb6ba9c12c17
SHA256597b6621006785b2b4b1d8cdda26c575bdfcdc5a80bd2e25d190770e900331c9
SHA5127969403d71c3665f7fe7509321237919602b3f99443de736c4b7f3f99c2713ed4c420990fd63148aa87857b7af981f4579c20d98d527d7e1825c86718e050e6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e6b4f28f00649d0fd86829480c3ef3e
SHA1436c7c2e497dea34b4bdb38ef1226ee199e5704e
SHA256444f2f131eb76f9fdf4159d1ab84afc53a5f8c2c2d28e8f783e6e2d880242cae
SHA512ceaa6d07fb26d97cec02fbe88cd1eb4f6c2daf706354dcee87055e4742ce11066536d7cf6e937f82d006af2192e64049fc1d0e8b7b0979ad107763417a08352c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f180a64ba533c62d90d0c15e088ddc
SHA176e6b5a9bad346c7b82453b8374b134a2d0a954c
SHA2560ba99789b25a955f1b0bc386a2fbbfb9550054c1c02b7300f4551d3325754a7d
SHA51278469f827c8ce34a062f805c31c404e8ae6befe9a52932f646e49efdc8b525111c3f5d6db4340a7a46a12d2f656949d4178ee3af03254f0053510850bb70f6d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b898ab0cfc8964c12389d27f1c4c03d4
SHA1a751c99de2bfce341ae9f912807921041d94e383
SHA25675376baa8d5516a15551a5fd79f3b7c0e095fdc60e2445022676f1a190b68e65
SHA5128d7ba57afa4752c56fee9ebbc0f0d39604baa9b2f3440bf3ef5858352895a8c4074c1f11f94d36da83e65645431675ba9d6ebdf7ddc5135e545625b5f77fbc8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5266903ef3592ad19efbe732dee52c190
SHA185a1642db91b521603a431e3d3f8b247ae9f866a
SHA256f7441866bed7c0c31e33301d6d8556974ccc2b1fd0bfb1a4cfadf356cc80a26e
SHA512b403016c0eea1bac585837b767d82ac1f4e525afe8ffe59f32d3557ef8558aa06a927384373990dfc26c89df8212b3253d2f613dcc2cab1adea05ba69fdbfec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5078494558767a5b613a4aaae4ba12fdd
SHA13cd2a86e4722c321716294526a1ae86bfc81cb16
SHA2560355c4fe9e1fe986a6ced259ba6e00bd412b1d4f07a28b0baf8941294cba443d
SHA512c148cf410b288fb245eb8befb4325866f914ee0ed7c79d0e0a40b6c437d6402c6fed403ce9e1224d14bc72e206acdd5244bb416ced5bbb207a716660567c2dbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b1fa30d5cd0255f16905cf9bbe79bc6
SHA1642c2889a977bc05030c786c77b5463a33a4ab62
SHA25671a38cc964b4394b78af477527ca30b76d23968ca94ba1392505c2c6b5315be0
SHA5125c731adab66cf9f4c8aa3766af5a37038052ed11834bd2260f173dd2e21a53ed651a1569930e7d45060e393ebad5a228d106fef69dd2e1fc17b403d9554ed1be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f2c336193a209ddf33083877f3d2288
SHA12d670a6be0d31b6fca0a809fafb110a374066967
SHA256ca55057352fabcaf904450a0d1b49d7cf1f9a7a73d617e728d2b8d577424f6a8
SHA512ef21179a298d28f6d4fe940cb285ed086c7753ec4eea8c2d299c1cf8e25c19f97243af944398f794ab3adf7eaf59fc6f39578d3e969a7d54b152c348e3bfc351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5823af24a6c53f70a28b38b70a6155f59
SHA1d178e0a59bd815971b2d7b5eb2ba37d21cce037e
SHA256629c2d3513953d126fc083290648a8e5e58c52e2d09021c313d42eddee30d024
SHA5121623c7674bb2983086032d254b011f30bc609de0b805e57102e17c6956009b57d80e753e2dcea7f44951c59f77b8c999c8d9bf5db3a192a8964b94a310aa0ef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5972921f78140ede941db251c02123094
SHA127f38454ba36de92f40ecc29973d70b4ec3e53dc
SHA256fdde3d880c8a8629489b34630187b95503b970d54e586513d72aa6408e2241f9
SHA512a293574e075e8860ef559726e5ec0645d11fc19c16f0708eb075b6f9696aa3c4fc63f61ded01ab690a7bc15d08762e9cfdd48b3eb7dcc4ef4901c84853a4fc67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c408b999a15c5c0a6e7bc5cf027410a
SHA1ae2397f448566b1d409cfc91ed6f314ffe37b90d
SHA256d2e0e93b4be3a0e249dab0b32c4c80da059fd5a30c5a85802995c8dd09844f49
SHA51262a557932a09ce5f2165bec58deda45204581297e29d51c95b222aa05780b03b4f306510c8db90f030de22c5e5b1eb6780228c3e92a34b8232389b854915f461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06