Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
a4191e84497fb53fb9e0e0444eafee7f.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a4191e84497fb53fb9e0e0444eafee7f.html
Resource
win10v2004-20240221-en
General
-
Target
a4191e84497fb53fb9e0e0444eafee7f.html
-
Size
3KB
-
MD5
a4191e84497fb53fb9e0e0444eafee7f
-
SHA1
d500ce645dd963da7f7a78523a97937d6976244b
-
SHA256
f03742e99af5a001e907791199aaf91645b52b664f29e6212175961c694a5dc5
-
SHA512
c5e1a6157da0dbf75e4db288ad1b15a70ecfcffb46c6101618f87caecdc2c1eca2c56424a7d01b1f5010a649a74cf0a501957ec7d6c3e517fa3a77f069fdd273
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B46EE8E1-D3EF-11EE-815A-6A55B5C6A64E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f212dcafd0d94ab778452209a14b2076ba5eb9d05f795ad7ac101582780349d2000000000e800000000200002000000039abf393010d754076fcd9ba41eb730660a9eb5cb60beb054bf7b8e96715babd20000000d93684d7d86e22696a350ff7d60f9ec79777ab912bf4e041640d8acc5b3e31ec400000009b680ad7b1fb62876602b7196b5ae8954f4d6b133fb39787b4f008cb61971adba5e00c74a2e51e804a3fd4b1d10f88976ab9f83f82c9bccfa6a2b0e31b3bcd6e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000015e5212ffbd61d3ac58e8c76869d96464ae7f1204d579baa7ed9f13a6a3f7add000000000e80000000020000200000002af2f9361cbf4080f9daa36b4f85b1da2fb523ba7d709d2f5cb763035f9d8f8c90000000cdedb72719dba10e1889aa08736ceac53ee985b643a836891544d1f55b2c8e9a997ab621c1c468bc989258cf56adc0b496f9c83e5907e2e57bb5556cec95e777d763c1f620d6878f80b6b2f3e282c48ffb472be8504f5042f668e7888c18a4331441caa87b758c5e7526c6948502de657b921da1cd3fa2874970a86e2ecbfdf3dc29ea51794f9e6d5a4ebe981054ff7c400000007a261e850ea652cbc9ec5e27d55d3a52c1bb31c9cd19cf0463811c5855b687fdd8a5b58d8e95f3b99221503b195dcb98fa41e94b072fe7d67f8cb0ebfa6712af iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415035565" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a2e388fc67da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2244 iexplore.exe 2244 iexplore.exe 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE 2252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2252 2244 iexplore.exe 28 PID 2244 wrote to memory of 2252 2244 iexplore.exe 28 PID 2244 wrote to memory of 2252 2244 iexplore.exe 28 PID 2244 wrote to memory of 2252 2244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4191e84497fb53fb9e0e0444eafee7f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a911affad01a2ac55c635a9d25c6723d
SHA1e699f37ac10c4ac65280e4aea5f0d3015f832f24
SHA256f3030add46516902eeab1d5ee0ff79bfd94d532be88cf2e32ede2fd89ab2d07c
SHA512826769c56ea8d68e4f677295c80395dabfa2063e2ac50fc7342d927cd236b663a4db46a3f35adafdfa1e806c09e6f133d153354848f76a40c0a768013fd983fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d1cff3d39b484bb77a9569d43be4568
SHA1b7bc2e012d34f7d52135d731d52b8e59ee5bc724
SHA2566817fae5782fc9a427322fd64222d83448a776fd4e67dec85592bba17c1d6aa9
SHA512d21fc2366d518973ba1b9914a1a5ca400a2a33076ff6d112f692f8e9d7e23535774568d010b603d845e2c8e67d4eb372651511ca2e278a7819ee435b687d99ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ba58a08764cd8db929eea3d0ab527c1
SHA1cd7317f4b82586dd18ffb6da5f2b3e56d08f2b8b
SHA256a58f56d129302108aff0c7a15d7c61405cba978fdf21ee4d6592ff0543f5992c
SHA5121f2fd39e0d42190f4bc9fafde7cf96164bf3f65e59efb566d438aed6350aec8a2b1ee71beb72aa358100fa483829b1fb22f2d99f5ff454f2339298245ec70a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5938ec96cd2357c7c250d659e22ef60ba
SHA11d94e8a64484c55c3f7034b54fff11a1bfb1aa9d
SHA2562bc1580c0f955a72c238d7fec08b8bd634e8336f96f9b8693b58ff1eb99f10be
SHA51237718f3d221ed00ae50453c8d720961375c159bf0367110d9c36b25cbcd59a83acacf541677149688c096729b3d44f186957a2d40e1b204f51bf25e8c157ab86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c46a6d15a0c2f931ceb5e956008aa85
SHA1c8a59865c0b0adb23aeb4ee86974fa9a7738d7a3
SHA2560d2691bef3d55fd434b7b14e500f0685917935c346b83055f0a1db993017b7ca
SHA51232e866eb65a1e147b7aa0367a75b447d4176f5829da936ed42806d693ffaeaaa0844398ea2ddcbd27608a7de4259acb89e369db84dc540d67386e31da9197e7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d74f8e438c26b114ddf68086da6fecd0
SHA1dd61b2c89e0ab83252427dec9c80c629547e46bc
SHA256d300a7c97bbecf1a296f0803c621292a561d192c0cb78e30a0634fcbd6be9abb
SHA5129c07c11f87723c6410186524f4f68861fced9cf623bc8413353ebd9b37ad7360c72fcc7a69d537be62d764df4f8ed190f1e37846e54f429e3155105e71b41310
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ba75020da7edb276f714e5fe07bd592
SHA1d489e8c51d15523591eae1c981c3d5fa0bacfb3b
SHA2565d86686c8a2e58bf839501f839dbad6910fdb355e64ea685fc7251ba72eb2cfb
SHA512262609724beda6955a0bb6c0b45cea0dba87e5357b4b6eaccf58dff9ae27d5b332dae18d550aecd8c217b96d6604bf2614afe79f56d46b50ae8fc61d23ac1cb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a13621d6650b631b6edf3d55faa1ca31
SHA1eeab4fa7c81b4d7b3f74dd6e51072a8b184a018b
SHA25651ca3cbbc287e954fcd87dec26c042989d8b4c41306b02ffcc11dba9e1fdcdb1
SHA51239ca79cda0993631a7685b43321d78f37e54eb8436c7c3179a7a77a0f6db31941bec225ce832900d2db62b506ab58371123903626f321a96eb12c89bc8938a47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535f443509cd96404f5073cbff50b36a5
SHA1c8ec66ab896ba50ee872560f9a1355a50adeb48e
SHA256afa532280ea201fa5088444fb3cedf1640e42c6b8c5ba1f81e76e82f5bb3f4e2
SHA512998230013fe93869f2d6b48224cc6aa7857aa1247f73cf87fa2a1e284eb83f1c117c75cfc51aea61924da033ef0b80b6a2e278896d62f68eeddf4c246ac6cca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5746f35202c9fb5cdeb03c14ac86476eb
SHA15b5b3035944cb05310a9b4e24215b67dc0345db2
SHA25617c20de59a0fc57427037c653a49b3b77978c24090ef0c94482a95fa4e3b56ca
SHA512a3eb7b71c5caa30b87229bfbadd4652054639032f8eaa1cfeff5c61bff0915c562e4dce4ff018159618cf65ea07a1229178c2351e0b58c53865f0456d309e62c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b75fc393d3e3334212e13850b5f3005
SHA1cec5a96f32ed6454c40a890ad7de606d3b5e4849
SHA25667affd180661fd982579a90dea688a97e69942a5a3e30db7a3c941fd24e8dd31
SHA512ae8f8b030bbd49bc778f33e9a6eaacbc2ea6f1fd7becb7df6ea37d82a68278eedf67055f301cc69096a6acf951073ace9566fd64fb9c7ca5540762e68871f923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9f5c93c21564533d071f2f681248070
SHA16bf42f4a99b283ece1eaed078a0e9a172313168b
SHA256e7a2e673b97ca010afa6cd6a3713661df05ee22f9a5d3d62e9a109aaadfe4438
SHA512dffee0e3e781f4633b318fb2db74bc4e22e1b47d5ea82b1e57b43543ed6b7db57259952d443307a4febb6d1573e6d2ead41ee5704f840f87f67d13519887ddd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529cd80818e7772b9ac3051187de5c00a
SHA1769327917ac70587a7d1d5bed60b6f26ce3fb865
SHA256b7d1f1bbc58bffc3b7629fc226b19cd6be1c13662db8776b8458d53d77d91c31
SHA512c6ae86aab553a86380916a8afed643aa18d9819b53655912568f1c6e84fa3e0115b3479153a444622f48e7ff6087b473f02b0d5d99c75463913bfedf73efe6da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edad57c7fb50b1351d46be831e0253e8
SHA1ca07430007f83e7501ee77f219aec48b39a51faf
SHA256b62571b084eed309c19f55efa2ef055c68aca6d21859863c5c47c1ab1e5a779c
SHA512ba672665d1292f7430792e97e25e6a9209a0726577484f5612140b7461d6deed888a75fa9d75bbd05f4ab10e987e3ff6e8ccff8df40ac6242b419702280fe42d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f6396b8b61f1fd82f4a0575416440ca
SHA1a060e20398d06d2002b0048993d8e6a127f5a67a
SHA256c41162016f5b460869a41379238462248afe63d210495a2d00c51e1a24c55924
SHA51250e93c2b59a293d3bfe21aec9b65e4021b8ad7395dce8452ee5ccc60fe5ad35d13da14785276892db3ef33584ff8c9c04e297db39834ab92498960046d7b1371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a4da8952bfcfe2db4a6019f54b303ce
SHA18c7f2d5a61941ed7b9b2b6afd2dc764138dc6153
SHA256cd7a7ae920b2eea37542c82e94531aa49ad2f7af255a199cc5c188e89c73cba1
SHA512497db40660b94a44f5cb5172b3f021e687e945420e739b56f883c2acffa25f7745d9ffcd43260f2802cfe61c1c0abbfcf4a4fab451ff48a0ef8515a5361fee4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae3774b148e7bbff62dcb510d40693ff
SHA1a573353efbcc742bf41e3407ec5502badde092d3
SHA25688e174a4153b846ddc4579fae8f389a57d8bd4748081caa32ae514dfc0698648
SHA512f4ec3b4846b345ac2c825fa3554cb49fef1e5f4c25a90f88872becf3ee6b0ba04fc263719b7ce7f0fd4d5246cc8035cb939c4354988276b47f93337b1e922d0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c9f13c10ca78c3cc7a218e90a551c24
SHA13906bbccae161c1f2ff9632d4cf0b988de1ca680
SHA256ca48a4d7f08da3fd15a7aff9441b93761f944ce4e5f1724403d860348cdc0183
SHA51263a691a5e5954502bcc90ac18061706eb4f9c79cb2478965d5bd2523402dabcff79a3a36d6d1b0ef022b01ee79616265e6b209d92a6f0a036072827aee411370
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504299c029ccbacdf685e7ba49caf4fe9
SHA198ac8150f85332430438d5bf82d772f215c57fdb
SHA256f2cc03859da25fabf18c8dada9ce9aa3a55f3b6cee8ebf92e73d561da64e320f
SHA5126320d82792a3034dc59ef444c7fd0cb9b1273d8388da8862ce8e655e8f380c53803dbf1c7b6466e56e03074af49d49d7f8a532f3ba32fb63c0dc65c5fcb85674
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06