Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 21:01
Static task
static1
Behavioral task
behavioral1
Sample
519b324c7097253cb86d5a5f900eec8f.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
519b324c7097253cb86d5a5f900eec8f.html
Resource
win10v2004-20231222-en
General
-
Target
519b324c7097253cb86d5a5f900eec8f.html
-
Size
62KB
-
MD5
519b324c7097253cb86d5a5f900eec8f
-
SHA1
67df1063018a525cec4035e0d6c9b2b7acb3a75a
-
SHA256
49cfffe6c446912205b3962d1111e52b1f50cf0a6cbc0a209156ee67fb4262ce
-
SHA512
6c626021b6a8603b309f8cb3196cb02eb10269d748ac447e908db4a4d9dae3f9b97b7220d97f9a2d9436b507d2569ab6e674d303194cfcba73b8d0e9e74896ab
-
SSDEEP
1536:TTupBDjW6UEMACoHKERshFNPqpdodMhIiwaWG86N9ZUSpa:+pB/7UEMACoHKERwFRqPodMhLzW2N9Zy
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000b8d510abbe4c3919591cfcbce337cbd1b4758b7b1d84002cca1a7ff00617b076000000000e8000000002000020000000f360d93675becb4bb79b67b26312ad8245d3fbe5316f406aa9ed2444ebe5251d200000008595c5e9f29c69c0db6ca9b80a906ab7c8a240cd038bdda766f10ff8ee8e4afe40000000e483f3380e361c1b3a24b3bf9b66c6a224547f5d9799f5cf3611bc1b19d5e4ae2af4f7d0e722b08261fbc339fa9f562e95f33f574a05dd3aae7df67c87741499 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000000b788b8ccb756efbf94571fb6365ddca4f8f4abb15700b139ab8ed49bb86ab34000000000e80000000020000200000009391c8b3446a427c761f8ebe738474ade1aeb7022737dad82be97ebe1b91730e900000009ed401ed2e955858e5580d54dab4d17a8170520b5f08d76e7a7da7b5106a2be7ec4300001893cdc43a84f1cc4cbf5a0c6b8372293a45dd99f176c01e313d477e7e519996ae742a5d8accf653ba6cd315b739d9bf8f3a1fc8aced2e705311c54f9b756e560828364028df3f9f4295e930147d63b3ab740787173419f16871dc0f565c15beb7d73c20271245a642613ac34000000025aa87323ce809a744e5a88e1366ac1c939afeb39ef84cc409a5fe0b2a28bbb1cc1d110a5b07e53b39d1fe9002edc2714deaf9b4e567cc9cf18ac4cd4897fbbb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FC37081-AFFB-11EE-A2F4-62ABD1C114F0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fa1d500844da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411082344" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1704 1760 iexplore.exe 28 PID 1760 wrote to memory of 1704 1760 iexplore.exe 28 PID 1760 wrote to memory of 1704 1760 iexplore.exe 28 PID 1760 wrote to memory of 1704 1760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\519b324c7097253cb86d5a5f900eec8f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5ad8cf23fa36bc9ff083249b4cf00f28e
SHA159d687e573dc1c35f4be6a04deda6deb323aeafe
SHA256f86902a0b20fdef38f208a1fdd4e63581553e3924e0927865d5a34de9538fa89
SHA512d70b44507f3e8115b884783046cf4df212bbb8e1202f66286714c943b205cddf01bf76a9e2abf60676d5bc5ce40d6ed81c2519fd005f2c85d968d08ffa45e3a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d61d8e7c9368997fd5aa2937f095e538
SHA1472fbbdbdc32ce54ea9943ca41a737dae4ec1e65
SHA256ea8b63bbe4105f89273d84caa9818e45bfd9fa9857ce6e40737d90994ce188cd
SHA5128a73c813438254dbf895fd334726485650037b025c52a7ca24b5ecc53831fa5db14bcc9e25dfa374550f7c374f91ddc85590d417133f1e785d1ecfc2af9bc653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e317af0fef0176d99354fa76fc04b1b
SHA15b47ffa983d9aa5e94a2483446ff878c25fe7383
SHA256b30c4fb8f44381617e82dc688c92c1f30dd36e697fe871530a5536637f3c5f10
SHA5128c08fff9748af673e3665dca0ad97db74535765cfbb2bbf6c780d8570c49a613267542e092ca8bc6daa75bce861dfdee3f8a29ae2cb8cae20d77f9d423925cfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c2c2aebed91e4cd3ba7bab464bfcf09
SHA130110c8362dd6b75a641b1362cb4cb501b44caef
SHA256fab3781921e0fedca5eb8b1c8d70c37d5e69ce371708a509b437971ff16fb924
SHA5121916a78c33d9fef72258078cafcf78df24aded27af3497fe8f1aebb4dca9dbe215f73ddbb648717adb1b1076d55a159c14722d49b9c1fa5b99453e25ba478cc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ea1e1a42f0643b5af809d58c5b1fe7e
SHA18ea2ef689854fd1cf55280ec22ff478989c9891e
SHA25625f00cee500b6bc970baaab58bfaefe847d57c04b6baee4927249a76b56517bd
SHA51216b79264b8cc4ce11d4e1f3a9fc0eaf4d3cf3639d63a2c048ee45dc849fda2d2f4b9714e85a31206e2759a91ac1cd84cad437b40547ce6a49fb246cfe53a1266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526638e3b395faa6c48b9ec366aeb70fd
SHA179fc2f11e108b0efc293fc99792b702f408da40b
SHA25634fbdaed17531a02a1e96f608837b9c3d87798b52f3c22b8806da6e9c416243c
SHA5121e71fbc2d24498a1d75c624b43017954d48db9ee4f6ae4dd3f42a8fe9111d36875504105b07e777aa45513d7a0fc6577bd04ec3188afe98a010fb536d5c50217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af0479d17456bf387602a4e2fece843c
SHA13e1ffc7264455a645350d201ac524eb678026be8
SHA256c50dea840a6080b4177ff195b163d206189fa507af71d6b6016172d395b7e4e8
SHA5127d292a9da47903b2938e5e59b15b60ab5112cecb69e0118a81810d300c927ddf209690de87b11ba3f633b6d22041ab3838c248ed1cd3ec9c78f0e8dfbf35a955
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560b85c2e80e552ffe79f5d1981813af0
SHA10b204a42c87034c3e1bdf726c4dd10ad157dc971
SHA256fc647a3ed3e349a1b9c44b86f8a684a642301481e2be338b45d7042daa135fca
SHA5127dd1dbdc4856392cc7537dbaaec2b9ecc06dbbb371b99f69fa748e25cf5971afd449fcb84688529fb3045b53c94835aebdc95365399d5cdf9d817c55cd8febe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599eadbf38d9234137d3f23b5487cf4eb
SHA1005774d0850c9ad0140cf15e4c89a2fcc7656880
SHA256d2afd13271b1d9ed507539e00ab76e5eb8c1244752a42c7bfc875f2915fbedc4
SHA5126c7c22d2e1c13e00abd763037fa1ecb14b4c0efc3c2f6a5fd55feb9a16040953a43d838aa573961add4ca4965a320a3ef5981cf266f3c97f63829691940cbcc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5109dd7132c3629db48734852af6533ef
SHA16bf2b5e30cc2c806ee4158cafc294be412ec2a2e
SHA2564421168fe068b47ba129f50a5a42578424a03814542a9742a81abe2e2ae9ebf8
SHA512d643b0728d4e64d71623d021b4a385fb30500cd2bc1ffe5d2245388ff417596a52c64a4c58939015072feaa01669c49a1d4bb37e7d8bf5478dd168adc28e6230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f643529fa46d03804bf34fcb436d610b
SHA1baa21f0f6f1b79873e9cd0040b8ba50b6d8e4ba7
SHA256cf34ebf6b28b4c3229124346ae78bb300538203663823fed9f68cce6f10eef9c
SHA5121f39e0eaa3de2451d5385605eb3228b23059950b6f124150fce58dfffeba866a56d79ce1f868b94890a4e286a4de710d47c28e0c894ba65301dd4bc86f7b1933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\35D8Q1ZU\478691279-postmessagerelay[1].js
Filesize12KB
MD592169c8a0fbf6e404267d0705cdbdf42
SHA1a5cd88b74ca5ced239cdbfb458fe25540d671f46
SHA256dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384
SHA5128c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EKMGFIND\rpc_shindig_random[1].js
Filesize17KB
MD5f019fdda31635d2a31b151ad8ad56c7a
SHA16adcbec55f66ffaef83d9a134423aa98eb2a2189
SHA256c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831
SHA512fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M1JF52VR\cb=gapi[2].js
Filesize64KB
MD5ee01651d160cfc55249d6011a3c45916
SHA179d6121df6575974ad21dafce33ec98e3f2f0a7f
SHA256639d75299973c7d3794eb7eb129e3b5a6139f9f521e1f14383abd0fd501219c9
SHA5128a39dfc1ff2c58ac106225976aafdaf7befc0a28903a0c65e2c272e1967c3336af2b477ec12604400bb8e16aecee6567c9cb9d157e3d54649e28b9b2f920432f
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06