Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 23:24 UTC
Static task
static1
Behavioral task
behavioral1
Sample
4a0beaffcecd936f9651aeaa58ef3c01.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a0beaffcecd936f9651aeaa58ef3c01.html
Resource
win10v2004-20231215-en
General
-
Target
4a0beaffcecd936f9651aeaa58ef3c01.html
-
Size
2KB
-
MD5
4a0beaffcecd936f9651aeaa58ef3c01
-
SHA1
eb9ac61feba89e227d58ab518977c887858399fa
-
SHA256
03db880e5e45b63a1577cf65a0805db0d8b7c7f041a255f18b7a60c2cefd8af2
-
SHA512
573ac5a007ebd180c577e9d49f805ca8b150081f2c7d5ad185aa857935f84c13786ecc092dca356a3ad7c75612af8e12a7af50cdc86a84273787207fa38cac9f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003bfd9446a26d3aa8a8d17964a2910aca5b35eeb356f81eaf7d08606c94f5a7b8000000000e8000000002000020000000561273d4b06b519bf7d079acbbcc886770a9f0345aa28b40d83b6895236004829000000019b5a449e2bee331c4fcafabcda6e12d5329937229b29191d4603f29af1b69d4edf99a5aef4eba84f79f824d946dfd7220fe2e5a3d5d1ef360b113a7eaa6c04156f5388f317d461a17d15fe7eb7dacc8791278feb08833c8b345cdda52fd0afec2e6f7ebadbb8ae706f931a607e47d8431929919b6f185efd541aea674d3ac6f973aea9234b4e4ac2daa88cc747b325e400000004575c6397f4fcb5e867394a8d8e270476f91508022b7ebe41ccd3a231d1bf3824783e1c6550467d902cdfe24f6b965b9dd49a44a1ed60ac5277a4198546937af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410831751" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bbccc0c041da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBED70F1-ADB3-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006d76642e7e1afd074851b4b70d383c365c509b9a3cbc1eb27329d9a73ba1e39d000000000e80000000020000200000005778fb51c8d283929a7f4cf2c7b85efc9b5e5426a70b540d1f15a6a1d918b92f200000007eaa67e560c8a4e70f8b169c1940ce9ab5dbfa25838c5969c07fa5d68fa9dfa640000000fbefcc63bd67a767bd4ad9773dc2cff010cb64800a8099dd3d00a9e40cd950f95c7e8470892dc89779d29dead4e6a2b57f47eeb522b185f4e5ded6b47ac21701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1996 iexplore.exe 1996 iexplore.exe 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2356 1996 iexplore.exe 28 PID 1996 wrote to memory of 2356 1996 iexplore.exe 28 PID 1996 wrote to memory of 2356 1996 iexplore.exe 28 PID 1996 wrote to memory of 2356 1996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a0beaffcecd936f9651aeaa58ef3c01.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5789b9bcb83f744b68366c2992c8b8d95
SHA1ec9b281ed7a196ba36d1cd75b3b82984af3ed723
SHA25629d975d28620754fe8e8de10665b651bb2c10185a79984eeb82cac8656301cb3
SHA5124b0798f3c1db259169858462b821c22af83b0ca38fb80d84fe2fb97e015d5f9f8e0d5d2f6c2dbe687c6ea6fc3cfcffd44d91ac97345891a24b7adbb4bdc52036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc83396f7b4f564a2482ef79e130312d
SHA117b0af89c27627e09969506edb8c2b9d87d4a147
SHA256abe8cebf3ec7b18e39f15722679e286664d20150370278222ed2881114547a06
SHA512203243fe5aee473162853e373e00b16012a8acb4ef3027dc9f7f265598d18b180f3d9f811c0fa8c2c92aaf9a6b81eae659771a13fc04f2796f0e5ba5e33b6421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd98c37aff6d6f1e3c89de6bdd685be3
SHA16a8b17869a8c407f34302e14cb0f87d44b557827
SHA2560fa47c9dc1c5db9e013755455af4778ddcc3da2e494086b30264332ce3d023e9
SHA512bdaf2dd5466b517df98744dbff971a7712f799fec24fb24c4aff82d842e0466d967e49c26e9f69cb03cd183d1f1e0e094af356d97f1e8234f81b58175033efbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592d08bd429a5c260d01fb2dc1cdc2718
SHA1ff47fc64fd500b7d075127e9a4202cbcbc2d26c7
SHA25639ef1f1e2e2c9d75aba198b52eb0cb31a9f5d3fd652529a10d9deb9762628aa1
SHA512aed13ddbcada250946fffb2bdc2e343f50a52b15aa78f24ccd0ee1bbfef0d30d33298b0c70bada5cc50ddab92982e589c62a3d639b6e5b1007ea1ad1f3816130
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4c7d865bdebe4882a0b8557390b7f7d
SHA11b36c44f81518391e4977af882f433c84403681e
SHA256a7e9cb58581166db3f1ea509a281d85ccd4b3466dd0b54fe590e16d0e30320bf
SHA512c3feb03ac3d465a1a52964f4177b943b7adb266a8ff4d70dce46e21006deaa79e713f907417e5e3f8e5c2af511a8a46a31cd37595e6aa2068bed99446e57e5e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5853b8ba4703fed20593440a71119da27
SHA121970e7f0a680db06ff1650fb6c9ae8e136bc29e
SHA256810dc7838eccfc93c3cde1c27251cdb7dfea36f3a358dab3e505496efe993b04
SHA512f02a67227e479ce3d91a165faddef9d44cdc8a93c5fe74b8f7895cce48a8b37787c69faa006570ece6a47778acd3256ab63469fca46efdaadbd5bbe3a7a0176d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551cd1519dc6c74bf4b786cad61998c5c
SHA1587ce60aa70f3f4f11c37c68630d9902544174a2
SHA256a7054ae1fd6c1273b485d352c985d0a936682e8c34c53440ca42c46deba936c1
SHA51279093c8cab6376953ffcbf5cbcdcf3aae4d2bae06adf511e79a325c2c491a5b7c6a9e4c10818cc339d0135312b255fcdda9dee06691620c18f28747d883e7925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568072b96dedd82f167b0157a241fb1fb
SHA18d167ad3ead6a0601566c786a127529f26931db9
SHA256cb30a09570ef73a0e1852e58fdc682be27ed4effe24f0c45cf8def11989c45fe
SHA512b38eaa9b94e6c846e2dca7faba7ac3a945d470e7a05f6d6678a7bb96afcf1758c7c8814bb17c70233df8eecce18646b5ba0849c0c8511a22569812c79418ec15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ce3a6611b0ec6673f3bb0c56c4d06f8
SHA17a8f994422ad183b63e8ec1ebcf06d43f2c7240f
SHA25672981b3a72223b48e33869f6614b64a28b40672f361ce778af61685657a8691a
SHA512d30351a7f3d566eaba3ef1ccd5495e642bd4dc047b3509478c36fce9d6526f0b46d68d4c4214139b87d4661f2ea9df28c2a5d196b7cdddf2fe00e3e64fb7ddd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e37a1179b5d12227ee673555fca09f49
SHA1cc10d437224753cb2b31ee17558d197ec4626a10
SHA256b8237f2e563186cdcda3bf56ad3bd8b27d9550418b686cc83be748e5e8922c97
SHA512d889b7099e3244fc182c9da8edd34ec20cd0b05c14fb09aeabfcc91402534de3a06f9e5976c3b5ebc625e61f60539f77c426c19e87f639c4628d6814c7cac30c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54197a8346742af712cb541911ac2a760
SHA10fb138c9b8d6a7b5181eacda64b87c1b1f20317c
SHA256e59e2d21449173825c80e8823d860fe8327c129efea4b4f0711b448c13f017b1
SHA512e70614faf74ce56ba6e2a1b0545a170d8ae4f61aed6b1cfcc45452e86753874ed0c8b563e13fa45b64dc72dcb8a99c9d765611ae8e312b43340fb51932757626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdd7b891b2964fed07edd291d9cab790
SHA19e9f54b28ebed989c863bbd86630a457c498b068
SHA256341096decaf46e73580fc0eb34738ecfb15c250ed331149aaa9fb4fdd17aea3a
SHA512363ad6be070ca590e7cc5215b37dec4e66ef314c84eba6fb2d55bd6b1c7d9ed9e7b11bf9683297f40707dd36002fa4503291592b72c4b1f7930c4ed910f387d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bd9514b08a215d76e53d29597c83749
SHA1b602c1b5408032d82567ae325b6b6c61bcdf2c90
SHA2563e0d677af370fdb0c0bf29578a7dc44eaf84fca519d4af69aaca9ef1cd3871c8
SHA51211c7aa283100fca0264df58567a1e347f6e614ff0e6ac1a02ae77b7379b4f47304e2725ece8a353e12a5bddb310fbff62c741db31c5bffd6a7dc3addc76357ee
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06