Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
.html
Resource
win10v2004-20240221-en
General
-
Target
.html
-
Size
42KB
-
MD5
5f17f67efcf64b3843cc50cce259b3dd
-
SHA1
0c762500f57364ea2d5371bfdabe552a765e4e38
-
SHA256
5a263119d971a552d0ef9fa47f7f4f6a46e5402bc37df056cb4a8e195586ebdf
-
SHA512
4bfd48ffff0ae16660623e7f23578fe47c9f4b6b1ccb8ef813207581d59089b04f8a6f4f4fccab0f2bf4076e19da7b1a4b0968e88d52b739c270b3e3992a3134
-
SSDEEP
768:TdpqmL0Id3AAYEpk7IFvRP0Mad6CZ4VWwCW3KI8ivfJkPVoEAd2Z4VWwCW3KI8iO:Td8mL0Id3AAYEpk7IFvRP99CZ4VWwCWI
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414934080" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000fe34759f1a392a0663dae2f0815b2ada5e82813655312fb0359b9bb2ca16a4b9000000000e80000000020000200000002f3e48acf35e19d05a54ada738cb31e25728940d5feb3cafe6cec5b8e911f37020000000e41d2c2454594ba5f7e0156b363b19612fb0d7d76c680ecfd6507d83630a68bb4000000009b38c8d9a0e0f99104d9d0d68689a7b9145fbfa87f3ce446879938e05639d2a4df16b047e0600988c1868d700f401c79b0fdadd1faacd76e133d4d828bb9516 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40941f401067da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6945A2B1-D303-11EE-BF21-EAAAC4CFEF2E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000077bf7202a27203498fcbcf1784e1c720ee7458c22d1902b5726ff54b0fb05bd1000000000e80000000020000200000007d33cd303ad867fb94449013448843733277b8f258921fed062beedbb7d251549000000096e8b1bc3a9a0ed8987981daecfcaddecf947f2e572f9763c3827e96bbacf75ee07a26498c93891a0314d45195511a9010d947bb317e5e99f0a11212f6e148f21ac651100339f13e58b45b4802e2844a52424119eb27fbf9c68fe42c5b02ad4b855d320356217b1e50b6c9a765cbb6ebf5ae1a008825051390f17227e554c0fffebaeff23ac959f23ee8feb07204dfc94000000095c1dc84fdfe68a529ecb2d0dbfebf3ee7a95f53cd2a636e4f3dce5fede9b5994b79925fa23a2af1be646345c2289ca7f230c85766033d63e5abad1d00eeb10f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2516 2184 iexplore.exe 28 PID 2184 wrote to memory of 2516 2184 iexplore.exe 28 PID 2184 wrote to memory of 2516 2184 iexplore.exe 28 PID 2184 wrote to memory of 2516 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a27b732af5e39d33564124163d8b2778
SHA1a790d7635fad36ab7877b4ec36f6bc3a88265a9f
SHA25643e41bd5aa30e16cff7d2684429434d09c4a742362103b1a08a17329cb3ab13a
SHA512943721ea0a9999814a484882f356e0bc2cce90b50393533a1249263300d9812d11f0bfb572d6d75fdb421a7f7cbe3396a85a0c37f5cffb2a4435ea7b82450732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56aff961701eae5aa718472bf05ad2404
SHA102b73aa73f79305a6b80223c85f4238c7554d140
SHA2567efd9006e9eb5648d0f88b584741fd2f7e9dd994baa5b9f520b245f34d25ed19
SHA51207b4cb4ae6f7a91e03ee1bd1dd8e5c0d38ffd9e40bb77aa2e38382692d8646643fe0b7225630deb9beb9d896159ae7937c64c94587e9e15f489de94848ed3612
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524ccc5b420848663d175bf58a12cf09d
SHA12babfc97af65ad42eb6d271818e46aa4b14cd5ca
SHA2566585310825a2c63b0f24ed7d878251728b836d45412806e2e412086d3c3dc65f
SHA512e038e8a2e842a36e89b5da4aa54f630b013eed5aaf7865ae09ff397b1c53bf9b3f08f3859456d542b557d344f1cd4102717f4017d3b931a27edad5a3ebe334e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5470bb7784502c7fd168fff611ae9304e
SHA131248d66da1a1aa31c6596a34bcf3f892232ba46
SHA25683e8ddfb6c49cf349b4ec33930daf3f2f769597e3c7a2df0caa4e13b39e38896
SHA5128f895db0b86e00eaf679f0ead282b8a5aa6c4022aaad2a66123ea85c921839de56170fad7a03c1724fbfe5bc52c744d70f9fe99ca384b34b955ec49a9122cf13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b66a557d7fea462aa6d276c3f3f3e91c
SHA185cf1a0f173c5315f1ea22c5ec4b9bc8f67b9d01
SHA2568357fab462e0f2f56283b740d69dbc8a619f2a2ed81a7b8eefa63db462265d9b
SHA51255f6ed6b0f24b447df7c2def56458963baab734f29571df15e99f9c4ff2c5c6fd38a23ccd2f27edc0cb815123e0b698f9f1ce1a91fe35ee828fd99f7c100b07c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c9291789887415def88addd198e2552
SHA1f228366ac98c33e46afa92f2abe475aa3a51fa26
SHA256cd5090906c68b47a84021384ca39b5fbb1c77735e502b1c81990b24d0bb3f93a
SHA5124a3ef3be8c410a9d7d14949c31650049baa601c0507cb32ce2d97d5aa85a6b8fa5917732308dc1506b1eb5ac1048dd5c1f5e465f9b81b827701647babaf6c8f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de13dc894752836bbc5c0285f175adf2
SHA1e2d5f76d6542d5035254456313fef119e75b28a0
SHA25688cef7b7a2fcafbf5e0c88b9538ede831c303fd541a71a4aa891ebae2b4e609f
SHA512b29807088b2186d220f40472ab1931042266fde9b8efd2df373d556dba727fc2f0bf74a52ef30f8c5fcf7f4e3fc0abbf8e5ed6d4d4c9737e4592c5dd87f743e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5239b3cfc0040b8b7de2d41d6af44f017
SHA17681b3bcd74ab79bf39c9fcaf29de7901052da5a
SHA25644852d6af53cd8ad195a1c54dcbcc109d2edee8a59f476d1d26f92f1595e3e5c
SHA51238cafea1d11188e6b1c5da39869840bf757f60bd0c2c0553c2d82cdb0695791a5389dc18d7456316b2ba9279da4fbdb03a33fb76b30903429a4b6ba459e95e01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdada2e23af29e2189361bd0044d86f7
SHA1c4b11a72330c32447a2f561ad7442ecd45924683
SHA25697c1ca5d4d9691317780509193f96e21d0648815a27d7bdb7a768a8457c7f4bd
SHA512e4c7a767631c669146d0a9321324921b47da860fe83a74a36d62dfa863a9198c1cf46f128baab6e93cbab0127e0e0263b0b2392b0169c5e68f9355eccf7504cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf918341dc6141da980c4414e747b4d8
SHA1292862b202dde2bfc66af742207d802d6b4c9dcd
SHA2562e9905cc00539072079b588f797028a0f9a0dfea6c277cb54596d0c9462181e9
SHA5126514d558646df978fa1078325c24de5269a6b52da8cd69b7e180d78199f3200b4ab2273f62cc6cde5ce6445953370ab073f2471d5c9dff7ca1ee23ea09f76703
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52929dcfe70d5e71aa2693e7e66d1047a
SHA120ef86e668f68e3c09795a66d76c1800ac42319c
SHA256abb212929a86be47170afacfb9cd7639f80269d620f380b11cd7ef1e28390126
SHA512e5d812a30633b99c2b46ac4bf0cbc3a88db1ef0acab37537e5205ec99dcd915c1be488523775d2bfff7a82b59f84d3961e9b50d432ec4e08f87c4207e162f2cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586a52283e55a3d2a5b86c005f46535c4
SHA133d65e2cba1b56a037ba8c8805dde9ef34cd1c5c
SHA256c0f38c67eeefb83e863aac0f7489ee036cac2e4af97d3a3dc2026bd3698fb166
SHA5126b02280370f3750d7a0628ece0e573e6cb9903d3f728904895b1ec5c0fdc6bd3390df02a25beef9a85e7269b3bea81617308e1261122b45e9b5d78c1ed0be2ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fcdfcea5cfddf6ad4b3736da6af8172
SHA12c2d249caba5d86e278b3b644d901ed54af96b6e
SHA25691f110ce7287a9b5b16c1ee34bb46a1fd46a1234cc7324d113a06e1872c9cd0b
SHA512e26f2e06c073b2bcfa96ec334761c01b88cffd9d6887cde2ad19d8b0d4eff5c0a3c38b4ab0bbcd4929356abe0f6de6bc9f8e2e6e8c904261f7a1af4b63045840
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5857073e402030908b066ac9198c9aa33
SHA1a5501d6d2e0577354784bb469e530fcc46a942c3
SHA2562c52f77299158ae3c44cd992d2572a4db46016a6fa5f5aa2d1a1e57b531f889d
SHA512e81fecb7d194141a0ae73a43a6f19fb779f1510b1703ed9e463fed44d072d190a6cb0a4779ade70ce932c2e06586e950c457520125412293fc0bc188aa61d9b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a801308e6de7e76dac0913f57fd26b0c
SHA15b1b3b777579f84cd0291670623786eb4263e468
SHA256138bc154f8f2040bb404feca359a11d14138001d8257ad6e5acdfe617eac8582
SHA51202719534f2de4d2e69394fcd1baf9282794e73a13dbf6b0fd1470688281d0e5ad6bbc1fdb88bad15c1c52bf39be430ce4a4c5aa225bebe2b18cac868e76ea332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53973d80a0e858dea6d845da8bcfcbdaa
SHA17cc2e467427fb05613623e9afc4fc88c061b461e
SHA2563fa15f621e072153d52c2b754316c7d672f773dfcf51ba9ad1217f6f6f809d40
SHA5125d7a5553d81ac83319111aa99a5d06d792507a5a0289684382951397c877372deb3b98ff8b4182403e15d08484b8f292ab45d424598568df8012492105bf847c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c14b5231a134fde4ab25195e99ef7918
SHA1a401d98666eb9c5a8fba3cdafec112b1ceeb8739
SHA25607f3b825bb5e7c91d92316dcfed81d5ff1c49864ece5a5cbd0f2e9bbf44a865d
SHA512ab7fc30e4f0a757469857a0ec3cf6ded16aaf921891200c413a9cdc4b11d392534eaa56b82688ffdb94cc94648b77194184c6e7c46d591c1687056599b695fc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce8ca091d342c703dde8118b681913e7
SHA118c68392393d89381364486439922b5ab4efc496
SHA2568109c6da3cd314719be0ddd6c6ca7611991a72122f5baa36215ecbcb74dbb0e0
SHA51266a46914c39ca34b231d5366a5d0ed8db7319c88b4fbda3fc60a8b709d18de9251eda96793367122c733d4030893732d5b6638ae4b66ce617f731b51fbabf84b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f444270c11c1637a8ed2642736e15c67
SHA18fe92470129cf2994d6a66817e71e9bb4cd7f5fa
SHA256389a5b97748f2bd67a8f67150621182bf6a945f5bf5f517846557cafb241d3ca
SHA5129f5793e40bfed854aaffd035f35515cb95890104517c1a532bbaee3a961c3a1dfd4efc0142e7db42f4a8241aed009ca44deacd6499bd9450707bb34c19621974
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06