Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
361s -
max time network
362s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
download.html
Resource
win7-20240220-en
General
-
Target
download.html
-
Size
10KB
-
MD5
cb08660747e3bfb38f6de8492385ed1c
-
SHA1
25205ec0c5e05a7358ae2e08921c53bcd8b5a191
-
SHA256
cf69e6fcb6b15f8521ce78479503da6f1aca7c1d4e8bb4270a043098a66998f2
-
SHA512
be01179210813eb1b40a3bcfa5bb211914f9c4027c6f41e3ae11d8d6f79f803fd1d5480820533a693533c3e48af248bcba134546b93c6c613e966679f4018d84
-
SSDEEP
192:D7eKv5ia5iOVVVQsjiqTHwtH8AHgPwtHSYwtHdwtHoquXOuluquJEuccuDD2+nnu:D7XRVVdjnHwtH8AHUwtHHwtHdwtHjuXG
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f818784bf3ad1e33da487ab2347c7ec6700a0e4bcf2c4c91149dbc7ec513195a000000000e80000000020000200000004f0cbbca85495ab8684bd7f659f80f995a5df77c7ed96a2219d10a7858577a639000000083e02c1a76cfe1eac56f302fb9b44b1b00b336010fb2477529b20b57d1117c19a9bedf9c2b353dcb49e531fa0e897f5bf113a25805ca6c68a039ca0cedc4eb10c056609981acbe108d79b23c97d36582ba2bf5536914c13d11be9cc16497099070b89d8e76a499a8e642c26e50525a5450e34e8c2ac7a9b15a1da2ea26b95e86af7ff4e39d15120a489f5fa5ebc38018400000001c1a2cb4749497fa948645e38ab1201fa790b9e391a683a54cc08abf5da9ed985f5b2aeaf3a828e44b9db7adde8b57a7db683e668009778e10f714e04317035f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000051c41da5b1125382a38742fc08794d1502a64bc05481db7cd043d5f62f0b112a000000000e8000000002000020000000911acae1d18d53055bf83a11a5b717d228a04b897191416a5f4421ea6510fc7c20000000ab2ccfb448dc6b5731b6fce6a50376ef4f4534e234e5facec727894c1a6cf5cf400000009852ef84043d79ac99326cf3a9ca525b997bc681dac324c665b705856d3f466e0d75e0bf60583992c19f5c0a33f1597b5632c4f7944490d84b723837227965f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70eef8f3fa64da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414705034" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F753181-D0EE-11EE-A1AD-46837A41B3D6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1932 iexplore.exe 1932 iexplore.exe 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE 2968 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2968 1932 iexplore.exe 28 PID 1932 wrote to memory of 2968 1932 iexplore.exe 28 PID 1932 wrote to memory of 2968 1932 iexplore.exe 28 PID 1932 wrote to memory of 2968 1932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\download.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae419c36830e195c66f09d0e0c200acd
SHA167a4d10e2c48fdee2b27db1cf0243f51fe0b470c
SHA2561ed1b8db37101391e8c915f3f380f65aa4661dbe70b745d325ad81785a7f2fd1
SHA512ce9707860da2d2ced08813e25a103a4d68eb218c0376d93fef3fc6c618f948a6321504776960e46ad5318c2a3bdc0b3b02b0741929e22bfa602ebaf106521981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50028caf81c82c2c48b30532ce2262bb8
SHA1bb4d3e35e65a0fbde1690a6757b471633fd10c83
SHA25668a74d25cb8543942d15795adc6dd98ca8f39304d73fc16f715d2ea08264d732
SHA512ba0e7a26d625fa09f43e736492e1a7ce23d42da772d190ae173434ac67a59a703da91dba0c9c82206d654f2d6d31f2264e735d4f6901de17c8afd819761b8b2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2e79742b20e930498ebc4bd51e018b3
SHA1d7706cf004e691de038c1bfeaa6388d8ecd7a59d
SHA25653b4c1bbd2afb05772144e5c008aa7cb18bc0c138630c7d307705bfc8483a5f9
SHA51258f19136fb4b1145ecee2c7ef1e014e9a7de745fee71b2b11f3ad02bd6e7e159e12fc92c0d1331c1f254a90044eaa792d1fca6b4b79bdd5b48607e97f88b4516
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e3f6188452088cc7122135fa6ffee17
SHA1424726a5897c090130e1841827727f153ddf5f63
SHA256a95876a79472fb6a9959451f66afb38dc5654d6aabca3baec42a4eb2a37924fb
SHA512928970d3e441c3d7b0be91e5a02c7c4addc35a2175b0b8dd3866db677bb9b8bc69273502c00f5d336b50e507a6264c471f30780e9345a3f1011cb5ef61b78fee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5029cbd505bad46bdd297787308cd8075
SHA1d585a50eb513ee445be1ce1df9c589b6140e8066
SHA256878908eba02bafcf987ffe0e4da0eda30969bd3c88068780e7bf47b2bb89001e
SHA512de91e3f8e7793ee37461f4e5708823d458783cbaf136287acb2ed9d9cb15f0455c4950728ef7d981b95745d1e45de58f13b466fedbea06cba550d180076750b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5428c260d60bd9ea12ee58d5aad162cab
SHA17a21625e40a82fe457d5d7b8efffa38238a52784
SHA256f17ba8986b4d6a463437ecf80259d1f5f8fd51ba6d94eeaba66548e4d2cb6ccf
SHA5127884244b57db9859022191c61853868fa1daf51b39d888784ccde7f2370e6e774b333ba048c29ef3d072f5c4541f80e50a92f4214f2a1a96bca6b8b1cb07d9d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0276e217ae1c01492f8093c491c7598
SHA16c4cc165068737a4a6126e6a3dbb6c586a8e7e82
SHA2567f413c6b0e7d0fb5a8ea1c5b9520caad7e3f46d8b719714d205dd72b7c4f5259
SHA512ca7db9f72df1c181756df3860ab04f284d61e37aa9c93dca08a33ed339a104a1f202e43d312b9252e7f0e3ecf91d135aaa5cc599a1f46c929a59d4e9a9720c03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50995462d896397af24553a217dd90ecd
SHA1444640a6a37379af882c7e6b7404723abd9ad009
SHA256dd22fe30c6f33a05dea4403575d8d03811045f7a704a386eb182aa1cb465ffef
SHA512aa16f0254b20eb8b522e53e0fd22e5e20813bc160d62526d223dae83241c5df7bf46b5eabc205d41c83af5ea16c50997adea99a00c6ce5fe1b01cda9fe39b41f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce159dadc30d50a359cce50654f8889c
SHA1d12eb9dc967cf0bb70e847375546f9dc755ec272
SHA256783e55e6cbec721e62cd17feac0dd3b8feca3c9dca0008718d234396071cb7ab
SHA512e0de758cb19caec59eebd411aa56e568d3215b34613faf5c11a5d4b6668a9e7c1c8d7dc706972adc8744337305586b9598e71c989703373278443e167098c1c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5448a062f3667cf13cf8d52dfb80de502
SHA17fff2c2512bfd7cb7693a4c11e57a918e7b349f2
SHA2563c7dfe17eeeb6492f1749ca70a53e8e70a31c317c6f205989bf37001f0801f3d
SHA5127b74df8231c55183e1fe6866d7dd7a1d8f66d81dbe9dc160fcd19d0e9a70530a4e5cf5399fa184e05545e154375fce013f245a6cb5e7f9ddfadd0b768d1c3427
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548afe85d54e5ddba376224737f9f7e02
SHA16a50a27d5a290ba348856c05d88d4cb466e51198
SHA256bb99da1a76f5ac0a9e113e677c39e4a87e77163d766b26ea1eb5137f4978958e
SHA512e981c0bfefd8aeeaacaead812782d1e5614404e39c795b0988641bb6a6e87ad81523988b915571fbcf50e8d973c23761bccf6c263ab3c80d224bf860c0f8ffd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bf1acc55111f002406bac4696b98fc8
SHA1075d12502a89ee3d1e7936328dce3f9925451b8d
SHA2560f970685c2ff4fef3206edafd4fd8b2a6c5f40b60f97a578ce5a57e179a4ffa1
SHA512236102de03f8d81d310999934fb51f428a202e87c8acc5d14bc82cb3988c6371da7adf6ee8582e8cec72d6e4b55bb146355ac5bd829f126b69859a1da85795d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc6d7f70751c45ef3a9b6b33e64df0ff
SHA139d9fb34da308dcbdb613361e8533443f408d4c8
SHA25656428b6eb588d52631f72b9006545549e08943c6bcc4e67e452f986305482bd5
SHA512db43f3733c39fe7c8a099b5c8a1385fa462c84d9feb80c0f9b57503cecf08e7e50a6695e2b4b23a01138a9acedf858a3a2d3d4430d6c5282e3f38ac01bc2b977
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5461a89b76e8496d74c32fd699dc5171a
SHA1c2a38212fd0c285e21f9cb8a6636883b8b7370af
SHA256e41e5df8fb68a5e38e3339b6b46d7eeb6ac9261261fac35ae58f6dfdd3f32872
SHA5126edaca051df91e2875a9960347a1411205706e0cc802e5ff0fcba757a3ee472d446577066083e48efbc88794e34b3a90c74aa301182d9eb078b045182e9abb63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b630155cead615e7cce291e88b338a80
SHA15ca2f02a9a0dce87f9d8dc5e51cd9a36ad847974
SHA256861f19cebfd71d6b598fafdcb92bbf0951eb6e100a1c6fe9fc21aee50219892a
SHA5125a251976cb2cac18d9d527a1fbe658e4b4302979a5f04015f6a55df2f7bd179496c23ac9a455b0e286aa383077987c4e4feed42082f358d48d42bf83876169ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ef1918fa02ad9f890039154bee00a43
SHA1c1bf16e2f3af87f418f8c60062914843b3300646
SHA256b7a616074fdb3a92d64a70a72238677bbfbf7c8d5e2cc35a45280c3e465af5f1
SHA5128cc0ae218444774b069f6b372a2cce8e96b7544736d996528e6cd7869e839039b32a241183972c87b5a574bef524ed5cd8e3b4c9734c0e22e86eb88b9988b78c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544958b84dc88045850b0ad4c98376127
SHA18e41294ff137bf846ac1dcf83735632c2112c488
SHA256b0cc0a518826d26d69e004f7796f75e00606ec32648f47f36b751f030fe57bbf
SHA512df118a87fda10bb02a0ea3ff4f5320d4efafad90de106a459c78263221ea8a715f372521e1c47854eb7030e83d005b38ef40c9148ca6012dab5987fd55c50611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533343d7ef7ebe20f0555ae09998a7380
SHA1d6edc6a53f94b180a0c484d6f0ffc5e18d50a0b4
SHA256e5ea149eadde7440d4455c68160f82521db4cb5f8e83fbbd98967a05c7ba3e5d
SHA512d7fbfc10f3ded73d713d13560a1a114d140ff1df41ba3ab3dd6bc5a972d6062db31aa6bd2ed7f9b6b10ae090adfe0846756404921084828aa083edb15ebebce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df26ac051404ed2f253bfd0dda427c1
SHA1bcbaad1f8ab67a596619c884d154f34c2dfd0f44
SHA2561a124ce60d423ec62fa75b57a6d2c4baf59231d46e23f2782c6894a74b2c0465
SHA512391f46d645ea791052fbc6e8639a4f522aacfba98011ebcce8f577dba79dd32fe71ed937bccc3417d52be3be44118fa5ab8a9968a5c0261d9aba17b910975590
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06