Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 22:43
Static task
static1
Behavioral task
behavioral1
Sample
42197b745ce1148346e3d2e948d95e1c.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
42197b745ce1148346e3d2e948d95e1c.html
Resource
win10v2004-20231215-en
General
-
Target
42197b745ce1148346e3d2e948d95e1c.html
-
Size
71KB
-
MD5
42197b745ce1148346e3d2e948d95e1c
-
SHA1
17fff3a974bde51b7dcfcf7ed1aa9a608e6b723f
-
SHA256
3539c8178c28157673b7514abf9902bb8db1db9da5d9026b21de2d0cae729f70
-
SHA512
3750fe44be2397cceb78138288d3ce49fef3cf088b7f8a06f63fc5743974bc3e69b35e925d7afbf3c434f51d2679cdf3928f900b7e0f5a296fd7a28d9caac21e
-
SSDEEP
1536:4NZ3HH2lcmfHlnP1MpDL6Rd3KLo8I0k73C2j+rUv:4NpHWyInP1Mpv6F0k73C2j+rUv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000006771826a19a54e5a54d1f87be854496dd36ac307ae150139e5acf519d7dff6fb000000000e800000000200002000000064e057ffc5df307ae77f271a37beb5c9a792622074ab0db7f3e90b070969feac20000000fabf0daf419613a597410cd8f8fa1723b6526e508db965018fa3e9142c5d763c4000000026646286be772e0a10d32cc36085a0740e382e3cd458f097b2723c738df5e0a95b6c913a5e9abee36a59b31049701e8d7531986f3db788be6fb0d801ea203c13 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0fa63bd5f3fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410570150" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002224254742875e46b333fb39b868ef329ee7f1db8053f844687b4e502786abfd000000000e80000000020000200000004ff4c3d70c7292e3a04937bf44a6a536865cd17ca0c36c45c44da2e22f2cfc42900000009f79b4aaf7b3f1a020db3d6779bf293359b0569547d7a83e6ce42123bac6bf20d14e0f41e9421651596e5c7803a83eb306541f471a8d882ba65e5a6ab634afdea00374992e252113f246e9937b05a23e40748a81611bb456b68d5a92ea4f795a7f9bc7500ea02cbe8f7588f37a9cd910a53383885e1d86a64d66c9faaf3c8d000e2a32ac0532caba8811935cb176300740000000fb37349ecf6ce919ba2a78daedb78ebaed04dc118f0eeacad850cf92400506769b247cc58ce27b53565a5e75a4c46c7975e168b0fad905b94dea90453eaa3db4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7507BA1-AB52-11EE-834F-6AA5205CD920} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3020 2972 iexplore.exe 28 PID 2972 wrote to memory of 3020 2972 iexplore.exe 28 PID 2972 wrote to memory of 3020 2972 iexplore.exe 28 PID 2972 wrote to memory of 3020 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\42197b745ce1148346e3d2e948d95e1c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_C7CF4FA7BCF717E50C9341D69112D7D7
Filesize472B
MD5dd3d01db76652a443a287b0392a9bcd2
SHA1a18bacca890422aa678936335f0b9a383bd4d5d2
SHA2568f834649e9412eff7c96b6bf12f5e6be1d7e2b47038817a0d754664010193bdc
SHA5124564cd6cfa56d9dbb9d105fc0e9a02704271ceae58851f59370815dcff8978849af402acd03009abea51b3330e618df97afd10105e8e380843f845ac92bab54b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5426fcc4bcc845a3779201a5a527c2fae
SHA104227ce2ff649b3030896bc9db7929f0e53d65e5
SHA25654072a3460735c2972659f067aad523c040bc76ef0ba92bc029d77ddfa39c3a7
SHA512e7deb5183dac9a3e3c0118ae47ee9cae6c90e9d62025c0c3965df34d14825577b7770ed936c2bf1a8dad3bdadf6e260d0caebe18fef9c732551f11b6b4a69dac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac342ffbcb2c77d8e7b6088a147c6f02
SHA1ad134af9ba80c6014700940098e136bc1a049a17
SHA256795775a8c9c7083b25894bccd45286e23bd16d48b4ff14335e96b19c3cbefe2e
SHA512bf8946b0bdd02a7ff6c3896b1532ef0a392a308fd3c3efefd8251f0c531fee56f15230e6c63ed13fbf21acbf4ea28facb43fcbf61760d5c6902be38648d1d8e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc58fddccbd6421f4dba23827448e8d4
SHA186fb3b97886a6980868aab6dd036e4ffbb06a8c9
SHA256be286075f3d439606f2203f88982adaacb1a4bc8945a20e82a0ffc4073ab8a06
SHA5121ba8c8fc04e1da91a6d4250733fdabb573bd608d077b0d9d5eb3db4b47637e0fdfbed2ba2516202bc34cda0a379e80dcd3c5553ef347d6082a28d618ddaa4692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586b4575c78c3872a56934574818cc752
SHA1a9feae7986a4c01a2417de632f5ca41e468ca6c7
SHA256fffabba9d7902a5ea23460f0ba18cdba367499861ecc75cce3f5d082175abe6d
SHA512bba5be40744ea6664a310f44f0c89fbf4fade7fc16570e4138bb609fa08941eb5a3f822ef5f8e24819f45b2cab7c9004fd63e6e5069e62e5e6720c4c1584758e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551a34757bf81db06a2ef10207bed5a39
SHA14e1fe9dbb82b3ff3d131daf03eb93f87387af113
SHA256e5142fb81083708f0ba4e9676c005d8355335856a37e856af597d4ab5a211b1e
SHA5121b75033de5048f778390fa87997562be232e0471d65e018baaab9aac79763fc0c30fccfc9734b62f52a39d344b91d56d6168c76baaeebd2df71bb21eb493783e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5956bd099df5bbf1d3789dc4112f55110
SHA1ebcf4464a79e0b7bd22bc11b538050a61a97c600
SHA2564a052ece01e8d43f07c96899140cd2693a309085b4a8965f2a8becc2894c0af2
SHA512e7bd4ec5f1df09d04ca5c1d1954b34b70013c989affdc725a0eaf6a2228f10c345abbe50799873f0e1e2cda8750ba0c5d02eb727cb488d9d21dda231601733a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555bfabbd308d108c879858e773fe7027
SHA11283f5228333d221a773dd6d7e53625901e9f2ce
SHA256020e3d084328cdc0471d77e4659ed844d6d3388355bab9e3da44bcfe8668b8a0
SHA51235a3a07c3df4982222aa16291c4e9e4b5abf18c66a7c6191dd7e743cae4dfee83bb468f7894c419f14cd9e2285839e55e4a88acd57d6661735b36b5a6af78f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d1ddcc1ef4f1485c2950821ce83aa37
SHA1bf3b9333fdb3441f1d62a8ecf83f4ef7f253f3b9
SHA25660b55003e58aa12315523d14f1c0c0e52c962db444f7bb2046e6e2a715b8b55a
SHA5127f8c1ca8550726f2da0d44ace9fe0087cf1088a9502f6c28dc3686c63d1497ee7973147468542daa2ce4a3befea126a39af88ce0ec8cb7a7b08377b1e11d9a27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52b57825f37be518411334b3ef0ef428c
SHA1dcd99bc0f67687272e49b9d2ab58ae8b101a4a7f
SHA256af9bc85254bf79d8a6d8ce73833d4eb9b0e4bf5f5e76eefba1c639a9c5c2da26
SHA512d7704d8c91224ba269206bbfd93a2e71034bd8a97d23b4b4d1a634c61335d536a8a0d6a9cb2a02eccc0a4255b91cd1617e76bd8a54f6032334a09114dc188876
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06