Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
44fe3caa129131e416087b887e39ee24.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
44fe3caa129131e416087b887e39ee24.html
Resource
win10v2004-20231215-en
General
-
Target
44fe3caa129131e416087b887e39ee24.html
-
Size
69KB
-
MD5
44fe3caa129131e416087b887e39ee24
-
SHA1
bafb11b7e4112f3501020856c8fcf676b6be1bd1
-
SHA256
d155846935de946f629b8c04818076e69434ed45235809315d5ed518ffd46760
-
SHA512
b1df85fa18e2d39646608731cad27f0e08b3b39b3bf57c610d4af8ab50ba69e4a345329d7c91fb6a254d6ac48569bb2f0c7b18733a7a73005cb3990c0582f408
-
SSDEEP
768:Drtsjhp++ffk8V/N7/Jtavr4+ZuvFU81cPZw:Drtsjh8IN7/Js4+ZuvF0w
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000396e7f10b694b1acd92f3122085e83417bd3c8f073f8d41b8fef9eff976fc6a5000000000e8000000002000020000000a537e5f4d007eeb2345df0974563a67ed06a236403fe067555f173a81b1d3ab520000000154e39a7365e3b2278c90a497c0655b573ef33ffdc72c66944d07f5c7a65966b40000000be8e12c36c6bb3db8647f6f333d12d2047eccfd9c094d26a54eefcde4540faa162042e2bef04aa3aa6a41aec46ea567c7d60d1bcfdf47db05d8f487905dfe817 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BE23FB1-AC37-11EE-B5EE-F6E8909E8427} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000009e2ca79a3dc926c751c9893220e22928ac622f066923812c70e973509f73d368000000000e8000000002000020000000293be0c39fd0a7398f85d7230f339e4ec24e8bb713f8f42609a74d43eeb3fca290000000340aba426c56af350cf3c3b5a096ef6689f65ad39e1482733624a8c24eec029c54a566e53cbf2d354fe05de995b75f86ec5c23403e775b66cf0bf34246d7baac47c592970529a80d82ae703f70e0686cd906d8793b0695eaa454e9b5c67b2b3ca625c045dbe490ca2ba6c892375ad2436e709465e995f9c44345275baa489b5414d07c0852d9c3406f42892f159ef4f4400000004dfba87f254935ddcc357b05060f2c0d8143121207e8dd91b9d2c90d6d30c2be4feb68e0fbb6c2407852148954f521f117f6008ed0362c12285e2db066831d09 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410668266" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ae86164440da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2948 2360 iexplore.exe 28 PID 2360 wrote to memory of 2948 2360 iexplore.exe 28 PID 2360 wrote to memory of 2948 2360 iexplore.exe 28 PID 2360 wrote to memory of 2948 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44fe3caa129131e416087b887e39ee24.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
889B
MD53e455215095192e1b75d379fb187298a
SHA1b1bc968bd4f49d622aa89a81f2150152a41d829c
SHA256ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99
SHA51254ba004d5435e8b10531431c392ed99776120d363808137de7eb59030463f863cadd02bdf918f596b6d20964b31725c2363cd7601799caa9360a1c36fe819fbd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b19b65a5512061cb0b43eaee5b477b8e
SHA1fccacf744c1b01b84ec74f24d0850a88cfefd77d
SHA256a42c527f0b8e16eb06502979754e111b49893dbf19a2f777ad9adc55a3e7e76c
SHA5123a98a1aa7385d4fae54a58c93e426e4c5803501f78d0f7c7b43c82bb55fe33f8b844f99695e5c939730e7c198ba11c92b7250e1f2c7288c15ed91d39c1bc3171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0aabefcdfe8d51f5245000bc70583ea
SHA13dd5f26b560206140460571a55a65054c56d86b7
SHA256f6aa34af7fccd4958f651da32a3da88364ef7adff1f4283ce68c978e76b75ebd
SHA5120ed7cf00e85ebc7d87ae6eb4c05d0442595d82654ffd0bfaa86642fd2d049aaf65add03281d17355d1875700dac9578b59d0bbde7f9578b623d63873a1433aca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d851d20a9a60595f0d77a632de14c90c
SHA19ce6c9c8d37f7cc4ed44089371dd14728e067700
SHA256f2553fae0432966905f23fe08c6d9407659142691005fa6504fa095cefcc35fb
SHA512fd14f0b03705c37806f0e3c7c093632fa37f3c507aee1b83641af11cd4878afed5c80735a542b066de49145c753d6c631b61c684a219a2e58e3d537a97f28f12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a48200ef7da243d54c354382a330bfb8
SHA1a7d812d1498d87a617e43dbe998e2574699d2a38
SHA256b9b2a26d20ce27b5a9b7734b3edb9d3ff2a87601bfd2176860f37b499a4e7d93
SHA512108e4e04b0c856869d46786ec32548747505bd4972d93b61c529a0cff447d875a68b4c4d6cb49a9f49fba75f2c4f0bc4fbe8edf822cc86d02b74ac4ee230ef22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8b6906922f16648e59ceaf10a5e12e8
SHA1fbb57884c37dd62f3235f5659f5ed621810a4cc6
SHA2567f2d079c97105d8411c5148b8d3247f415f16348645f5217d420cec646d87b91
SHA512ff7caa4baa61243b91d79ffd4dcbc576a2f5883fa3bd809e7b4d811cadd124f9db74478e8fd43eb9a3de3eba6abc8a26a33e4f17f2ae5d2a0cc67b0124e844aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1aa5dfdcc59b18434b60d1022b6ef00
SHA148c90be8ca83e7c187a568c1faa46d1c6450b637
SHA2562edfeb399f5edaa20bedb061fe27d903077366e045a272b76b6ce4b032ebd4c6
SHA512d6cb40bffca83c4dafa13469c5eeb742e2cadc7e6d2d7d35146f4a08a371f42a891e653e447988eab850bf7cfde47cfdaec33c23c596a0170cc03934b69f782e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5733bb5de5ab24e473fa3d47d53dea47e
SHA1db43298d44df718fa43d08b8d4ae7857471d9c86
SHA2566a8eff723ba514fe2b0294e70d314d207820cb41e87aa684a5bcdacd65294c98
SHA5127d68e9c153761837f79db1164fe39d73ce54d28fe1485a3e715129799a3bfb60d67fcfa926d010a9aaa5c80ffd83552f1259bc1804820c26f7b41507ac43a571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501aaf1a32dbef1152de598f7ca5a09c1
SHA10f3415b2aa1ef2dd9dc1462ea7e8dc6d43e2f784
SHA256d4948c65a0bcd1eaae453e9187ae53c1b7678f045eee1a7d6d276d63fc455ec9
SHA512fa1f7d8b2dbe44dd792c581b7eddfbd0ed3eb883f29169b9f949c6c08020b459afd4e67a443ec6aa19ebaf5769e08e269a75fa5fe1b778cb4e75492eaf8a33bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b11de835a6ad29d87c8546d7b7e8ea6a
SHA177050c4263dd0b88c0677fe2f37828447cb7c6c2
SHA256e7728f1a6434dd776a34264325351ab2a5ebab9ecad4667817982c8b3da2ff83
SHA51251fa10ea08f56e9a6fc888679a01ec05c334d2f02e82879cd32a34c948f7a1a69f02413edd4d25f71c45149af33e0d1fd7d355ca688e99295d882b2347cbcc71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5cbff08e0ce5619cf8ed64eee925fbc1b
SHA149e803426df0bfd3d9604a92098622c3d4dce39f
SHA25690ed7b53f1e4f3c16622cc29d21066a6a68a4b7f28c16d06214d36686b01db33
SHA5123b1e1442553f0ca9e84e4e9aec24dd76ab4f1ff4dc2928dc2b72a9b0ea8187488f449da38eba8b5154205b31764738cf408bc5d7e8869e44bc854733a3c07edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06