Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13/01/2024, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
58a0bd7db20ab7aae8eb1864184032ef.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
58a0bd7db20ab7aae8eb1864184032ef.html
Resource
win10v2004-20231215-en
General
-
Target
58a0bd7db20ab7aae8eb1864184032ef.html
-
Size
1KB
-
MD5
58a0bd7db20ab7aae8eb1864184032ef
-
SHA1
6052689a4975853a14ffaab67f3ca242897423e2
-
SHA256
c60e05d81d6aa7ac3d9b09684d1dc948c04d6ba3fb40775749f277b40947738d
-
SHA512
fdd3a281317f2271e64e9c4f8d5a2971418819fbc1fadc06f788f8dd7e04f2b5b1d053a3c61716efb356be216bb12ce0e0c203a55a3308675ee655435b0a68a5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFAF78C1-B1F9-11EE-BFC6-D6E40795ECBF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000d60c353a555db90ba998f293940892b5f0ddf3b949a92fa10a5f826665ea9372000000000e8000000002000020000000ae13b890eddddac7907be4a46085e89969c63e6d95d1bdb8760b937dd4d2a61a90000000f4714c3dca5756041c82ca61d639d6250ffd40aa4d94d58785187ddcad66038bca8f54fc661405a343a6a09f58a3167adc46578e8a83670d87ac36ac8f350e5a9f3ccecf2d823a1b07b9727b20d253d7360054dba457f8cceeffa51baf1a27c37478455544099f8a93f0fe9f42dc9740cfc395143341b41425fe971f839ed1961182e3ec187edb87e1af7b3de01c5573400000007f267b3d1bee7ac796709da0d1f26f040f80cde0664a154938d975c1a5e026e7b01571b9739aa56adb1a5ad3c09ee76932301df396af78e1a8ef940c345d315c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bf47b40646da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000b92c3bec652d536615702cc169bed9c8276d443e04954e073516fad7174e21c2000000000e800000000200002000000081ce6210c9fed8f42dc6db86d09ec41085369e54198327a04a8081b6e24cfff320000000b5c87184718fd7a737888789c9bab12024e856e42ee221e30564f4714dbcf3a840000000457687be8a100e19dc0a7881f81fa26dea30dbf4385f30bd313a09f88ac0d63a5644d9b7165fb00e7e2a0a92a47c5afe1bca5c067c779b4521340e1d8a9bd782 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411301594" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3004 iexplore.exe 3004 iexplore.exe 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3004 wrote to memory of 3028 3004 iexplore.exe 28 PID 3004 wrote to memory of 3028 3004 iexplore.exe 28 PID 3004 wrote to memory of 3028 3004 iexplore.exe 28 PID 3004 wrote to memory of 3028 3004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58a0bd7db20ab7aae8eb1864184032ef.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD511ba7fb203ef1b5e19df99828a2afc33
SHA182dd3a8a6dcce6961fe985488952027ed7181c13
SHA2562ab73e3c90eced79c7b061993ccd89e53dacc8afe6c7c553980c19e315c7ba23
SHA5120ae3054ce5884c23eccaa8c7d33a7057d32d4439157ddd9dc49f86e698a40a04a9f84c48b1b49b49911615fb41ad289a2deca89f0a5d65eb17078d554634021f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c31320dd455e2022f494b3f3c7a310c1
SHA14971558f04c475a01b25de4e535fa0fc2993ac77
SHA256d7f94d932af1271b4e5390c875c827893adad2ab33dfb42873ea82485570f13e
SHA512ed5e3b80b0f18173e9d84bd683274425aeb798596b528ff8199a13543a3f027bdee5d93d6998cf4da1e1c2baf7a7b1f8918918a805f8aa8550154e0398dc68c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8b3105d8232bff1da9fa6acd0d4c76e
SHA1abcf32e4f498710952e6434af8b55493be60ff39
SHA256c5909eb411e9062856213cb16fcf27f609451168b38c615aaaaaff182c571ac7
SHA512c9fa3ceb0d94da8b7fa838e126d89d8a722d516441652c8bf5792009ff5e1a88e606f09bfa65492659f3668d728352f362208cfd10d670becd41ece1266e46dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2966881b25de9fb1a13a3a070d65f99
SHA10511969d67c7e0a2576c32eb03793598ba7564ed
SHA2564cd39508ea584b826636ab07eaed7fd141ac031294de1b4a95ccaf445ad18ab1
SHA512a8b86c6f037a6e9aabaa6e87df77e53a084805bb84743b695dcf1ac47445d3ad2a6d22cb33b13d69634c108f442af0e2cd364c75d89790680e7909bf20da09c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505fdd0faf8ea32dcfb28727ae6d0db6e
SHA17960df0fb2e74544adcf4587c4cfbc90b02ec554
SHA256fd2d3b8c9c7e1d637285c7f23b4fab41bf974b35802c057e99db432ce9a4ab7e
SHA512077f35e0155da20d19bbdedbba66f80204ddc44f10dc72e6e3fecb91acbb6a6745aa8b6a685e89caab54f4f8f7c4996df6dcbc8b99df52efd164726d4b622520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597741ad7ca3e437a114c14e3a2691b0d
SHA12e863f933c42dd0dab1e276ca1c758c4be866d44
SHA2562302626208cbad0ecc32e249e62bce332c50b7d9cc6d15e9333fc2bff5eca313
SHA5124b1b71cc50a811185563bf9ac073a0c86b64be32868f62697925316bbd69de816e8378883652e73c8547409e389a53fc0f32a9835d474f1f496b7a592c5dbc3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f23b3d176bf6fb72409ce62eb0cb3eb1
SHA150bc33224be7a899838f1a166f0ccdc02b4325a1
SHA256c9b2efcc105fe852f87d22c1f1a826f3446956edd8a3acae60924993de8ed872
SHA512abf68573c2dbdd230915b3c63fea3203f6e847b390295d79f2e9ea97d2613ae59ca7d1c7b3541e021ae63c720b29c23d1e82b4190b6833373ec1f230bdbd3504
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fdc154fac1641f182c9010dda08b26c
SHA1555d388f4f41e2255936f263c2b93682fbc7a503
SHA2568577b58705c7ef861e7c4f709dd1299c0485f75fbc08ce96e4f8f0a3019c81f6
SHA512264b8645b1e4983a12511deb8e9ffd1fa84ba83b56ee7eab6ec91fcd37510912db19385e52dab492de4c1d2aac169db2c75e137aba1e3dea6b1c2abc4f5174c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546d01da0b04c84886cd7f07cfd8dab8d
SHA14c62725c9c74572ae43f5953ec5ee291d3761233
SHA256636633503b157ec3aeffc43de16f6de5abab7a408e10822902105b61beddeaf4
SHA512f4815e84a461f0bc8c681e128c77197cdf2d44ed47955a92e17c261e32ccfa4fd9bcc40da4a9e485d57655421eb8fbe31b7ac24b2a283b89695c813b6104b150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51aaa0299cbc164ede4401962a50ac7b5
SHA11a9484fedabb803a5dbcc13c024f511ee3e6004b
SHA256662c1ce15e8279e3973f47e94b34589f9f9ed5dfd1c0d757344fdb264359edd9
SHA5124d95e526f595d64230b4c9d434683e60bf6db47a38a4402e0f3f4fff9140c6433b8f0e1c4cc5c2635be2518448de14a75890381fcef5ad64b3df008108ecfad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f40aab5199b7063f587688674a7ea214
SHA1479dbe64dc1933f92e9932bb9527ec41a6d474e8
SHA256298d1e402ead5e27cd383a8993a8886b37a41ded4429387d168b10dbe8c9d295
SHA512a47ee3f2e1151971d411424e062d492980214f6a49ef8930c4bc54fc72c247f8f9b732e8a4d926ee4ed4f49ff7a762922a6babc6e5eb97f7019a9603e0cf40db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd532a72d3eec8abd940eedebbb5412d
SHA185b3bbddf327a3833d6ab96b3e71f56f37a45cda
SHA2566519322486d1718b88431d3b98123e671a02b64dffe1097d806af2e26d59bc98
SHA5123b04bad681faeac3326e5929c55aa92a771cd7dd522c1b42a2afcf6f29e260f7a124f91fa7464c65c532a3e2e2b80c629a41e7465b39fe67a1944cf63c42ba49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD51e69109d9328c34d3cdbffeab556da7b
SHA175a2f2bd92f264c3944d6f51d0ebf0aede1201a0
SHA256b8c25d23b5f5b1f12c479e74415f8c2bbdf1b849955d9608e1523cdbf9ee6b24
SHA512e2c5af47ad18434163e335fe0f0ad7771f3d0fd6cf3d28668a81a17c72343867e140ba0195a762539e12c94663dfa3ff6b4b6e60f380754db1702b4767455ca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06