Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/02/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
aa7a8952e9f073cae150458f3c0b29d8.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aa7a8952e9f073cae150458f3c0b29d8.html
Resource
win10v2004-20240226-en
General
-
Target
aa7a8952e9f073cae150458f3c0b29d8.html
-
Size
25KB
-
MD5
aa7a8952e9f073cae150458f3c0b29d8
-
SHA1
6dca0cee8aaf8a1c91779ac77ce7f158d74a7e67
-
SHA256
b816a6f606ed18ee0c16e7dd3b96a1dc230a7eb0b4e5a4f181dd0965e3d37914
-
SHA512
653d4049b78c9dfe1145dd23219b5cf2abdb596740a3d33c9c939ed85443750eaa4109efba27728a4718d0fdc6090b466c80a309f8c8568368b16e1e4112964e
-
SSDEEP
384:hdg2H8oN4GwzPED9NOUtxKTeBfKTph3l01DiVcLgWQQ/U4yhoy7jfIWrYc51IlSs:Hg2HlN0IltITe0b1cDNG9p6
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24BCCDF1-D5CC-11EE-83BC-4AADDC6219DF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000bb65e97b00c0421261b27fd1f235417a197e8ac85ba3c7a60e39cf4a3e1d9d07000000000e80000000020000200000007c17925e2310c87288a12d3aeaccad4bfd6a3d890b8af164929a675c3bedd35a90000000b45be646aeceef63803949c6e3ffd927d179fee6412460319e416071225390f1b6d7ccfb848beecfec2f3e5bff807522c9a353a944c10c550abeaba91395bf7d77d95f3a7d210f77ede5852ae1998ffeb46609088bdfafc13bf281ad0f09261fd97015ab74d7e56968eab666f6074f61ea93ce7a953a6a0628c9f2f7e7d95da33c8df3001aa1c8c3e9d11a97fb214b1640000000961a4d7374fa48149f230ea4dad2f733483120dbd133dc0bf81452611cf4e687e566f9375b449b2a35c792a17fbc17b8b10bad8dd811bc0e20d51b3aafae854e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415240195" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06cedf9d869da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000074b8b276c16e5b04af75eb08386f61e48a452d74f3665fc99bae8c32503be894000000000e8000000002000020000000ebf8d673587aab9b79d0969f9df849d80985cec4117fc75b5b3405429d8294db20000000194f388cfdd2b441cc44fe403071c32298bd83a7def2f23aa2dbbaaac89ee285400000004899195709ab1b874c527ca5af045cafe33118bdd4a648aae17792605b8dec243c28d14d7cf8c8a251ad3bcccd3bdc81d6c196e6e82c21c9017e712a12fb7dfc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2892 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2892 iexplore.exe 2892 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2736 2892 iexplore.exe 28 PID 2892 wrote to memory of 2736 2892 iexplore.exe 28 PID 2892 wrote to memory of 2736 2892 iexplore.exe 28 PID 2892 wrote to memory of 2736 2892 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa7a8952e9f073cae150458f3c0b29d8.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ac6101e99b279f64272595688768fa4
SHA17534b1f680f17816727200361f0a001559f587f6
SHA2561f05f2edecfaddef8ce9c5e09c5edf9815243d5163ab5a9b196c8d6ac5f28c6d
SHA512e7977491aefbf49d3a55e717707ff21ef30b11e684c6daf78a137c801418f68ca63c4de310cbac35c9a82b4e3795a5afe825c4091a7f65c09a463913dda933c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56197ee3a807135e4e17d95456806e42d
SHA199a93cc008372f90c8179cf0c6276c68aae4f858
SHA2561a9a3573021b6c1e0a11f90c30aa00f1514e839bc067c0c86a463aaf3310d309
SHA51264af2ba35bf33906ddd28f9cef3fc68c2ab59f319a57052474bacd3d1f42c351d8257aae707918611a5d32b64cb3a5d954ab31f9f94bd9c56fde4b4360ccdf2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509b031aeb89e6b2dec45b5cc391a821e
SHA1e80911cf666fe928124f2ff1360048db09a5d0c1
SHA256b435e9e32e6f98beae39a3811912f7e9f54b868b6636067fb7a680dceef8f1b0
SHA5120082f16ab7f0fc2abf3a29ddbf6676ff0d7b262480b9a6a3127afc96fb197053caaf81551c87724940f0d2d07f682dc58c20e9a52f14baafe91f220495adf20d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f98f46015c35b81ce38dcf6e462744e4
SHA11a061722b0923e99544734f30e22b57158b678c1
SHA25698574aea7ce94f1e6f4c3d33d03e3f26412004e174c5227996df19b69de5874f
SHA5128db519c6acc013a03c4151c63327f1e21d114a82511ec9bd94543e7ae8089797d9485b6874a14d4c0b59fd076742e89e393544b79be828b15158de2025689a4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaf6a22f9c32075dd9386afc59d9c9ea
SHA16d11bfa63ed9f06cc898c31ced0c92299f7db909
SHA256ad6c75dec29810a03f342333be65c7d6c63b792cc2a4129e04872b4fbe7b50f1
SHA51227b4bc775f77e53b683c55b06b94876ffb6350d10da88dc2a2ca14346cc0cbd32b5a8f67aa409646c323f64a34cce052f7295b6ac4079295e35df3d265e53574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c1c43d3c63056fc020177509ed8a8dd
SHA1782d116049b1879e60c79c0cc070bbb25381ca5b
SHA2563d0d84ce320dc9c127a6ea1a662a4a31c5e9056dbeff87b114cba0c5c5145778
SHA51273f4cf6596f83c6847f579216842870b9562ffba7b23af83ef654be56132dcf116277310f8911bf9fd5baeede79d17c742be717d6a76b5f933cac7d50f2bb27d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfb253d697f3164708be0eac32b6fb42
SHA19c5f482d9f0661e5f91cdc5f5cfdaeabf3a7f721
SHA256077c91c11e4ffec4d37aba3195eb5f79207aa4b52768eb96292ee385a451814b
SHA512b103204c98425b33317ba6d09fefb5e1d457d59d76f30f96c779fa77780f89409c342ba7d05ac81ddf4d2d2f9b1fed0ca6b624a22bb0f2bc67772d99a4c5ab37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be77dec38c2970b59116ca8b2e966b4a
SHA12705113bda4f2a3614b3976f5007724b66393007
SHA2569d9d4dcacda3be83baa233670469006e548a6e417c65be487f2176744dd5d564
SHA512db63e6ca4dd9fe3433403dbd6d974c583839de7afa9bb31b3245d9821b83623b1f659000069997e413b2c0df673a86ed5b1a7f820d96bb8bbec8e56109346c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a470a3c5eaf35452ef6c5fad1e5a3bf3
SHA19273ea04f2eab4aa9b2854003f6d84b78d55dc48
SHA256b36a5445af753b2d7370604f7dab13149df3b5c0e84038b4f459e734d639805c
SHA51206011679cfb0c180dfa4faf6f2b0562a0e34076522f5e4f9d9926d2a2edde3767bd273746806120382e865b5d907aad59f229497b1c627594da75be5b6fe5a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539f541aacc82e4dec10954b7a426530c
SHA12f323f99882cc2fb963318c4904b1787e619ae24
SHA2561138c7bc7bf8382143df8e8cdbf7e90013309cbacdf1b80f00b0a60094092302
SHA51287b3c9e2d6ea3fa06c23af5b7738450edb402ede9482030c7c367e09b12763ba8452676f0ba53af80112aa6c9308321623196a8eb5d82849f5f93d1cc2bd6233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4b2c788bb8766ec0631d8f7811edb60
SHA1f8bb5d550aaff953fbb51534a5d3092f1d47a413
SHA256f4ab0d0873166646052c1f8df27c8f886f55daf844de6bac918637e6de5eed82
SHA512405dd74b5d11d21e6cf992e52fce15a35bb65b5968b6bc009f5675914e8f470584ac9dbd0202ef3f360744db955203f6dda677c661780fdcdb5c8f9dae575ac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5708b37b866961e3750e656d8d2b4529a
SHA169243c52f76646f3ba667dd7136dd420ad6572c4
SHA256655aadbc2006577197a3210e4c27b5869832dd82ea317e697329e2bfdafb70ad
SHA512353a615f38b142dcdc12130612d3fd6f3a2c50e8490e45dded8925bc22b0cd81a658144284a7c83a57f4c42e5ff5c309936c42421cfdb23da89d68bb866e7323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585a1034f726895da19c894092cc3893f
SHA1cd680d9bbd8d88d425a86178edc1bc805d226990
SHA25644aab4494e09ae8d661852f6be70106c503f4c365668e5c250251802aadf9fe9
SHA51249974412c0f025ee49e1ca24c854cfdad27b7fa71121e489bfe8343895496c0439dc78f09665f25aa51973e14f9779cabc1f0217595077d3deec3aa39c3066b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f7688f996725ab7df64bbf123fb607
SHA1485a3f702358e590223d26305951ec12716bc7d3
SHA2565fcfbd8eb2bfd98c919559424485baee459291e15dcf4a13cfb3365635eb6184
SHA51236e113754b3e840854de9f350cbced40de12736fd4929b9a967445ec20220805ad7e0bacac084a1e7635d7a57fe3cb1c7b480cb7549ae6ba072704632b2b3f7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50df541b954566a8d9516de02fc3e6767
SHA12d172f3296635e56e2d3200af4df61643aa74041
SHA2561b5f61a5341055a8a7595cf9f3d58cbe1854b815d4bdb662b6e973cc6e99bd82
SHA51250890df34c16d7b5796bbc71d6e189daba91a3c35d0187d2234ceb9a8c6ea79b5b05f1b832af47043fd5b138e1b780c8cd44f45badb94bd66c5937d08ca2f3de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5650b77673a3907f7f731a03f8719e8d0
SHA1442f03c41c19b0bf6ef8cb32249ed114520c98a2
SHA256dc45f50cab46f8f90a6067a3d1ac60c5822a468af1d538147ae4e80efb7e10c1
SHA51219202a0cfeca6a0c5ea685ce15b353aa754407adf343161575eed5b6880a804a76ff97101b4424b0aadd609c8f3a7fabc918257222e80e303a190e4776ddb5a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a04f887809d6390e9ed2e28c3c2a1818
SHA1cc4cb9050cfe448cc177dae36e954039b968dcdd
SHA256e30b2daefcbc48e6640d0acc043ecf840a0c6c0cee04e4bb4dba362b94cd6fc0
SHA512393cf05e51a36527b4f720f7a6297afacbff705291974248ffc2936515ef33e1378fb12b95a2754fcbe6e1ea7c833a45d1b98573238b8dc5ea238362522c9ac8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7fe034fbe2e01bf92748eb1eb6b9699
SHA1399f11495a23e5a9ed054976d6aeb5397362a2f2
SHA2566947bfe71d677c288c4131f3294f652f07adf978adbc3104c96f3c321c625aa0
SHA51266470b760e8fd6d038801b95cf7639224daad3d958144583a2bf9a293d40f6905f9adc93aa338030c0b3b433042ff0733d3f58cbc381db926ed6533ebae88807
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63