Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
aab8217b10877fab18e4838dc722fd1b.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aab8217b10877fab18e4838dc722fd1b.html
Resource
win10v2004-20240226-en
General
-
Target
aab8217b10877fab18e4838dc722fd1b.html
-
Size
907B
-
MD5
aab8217b10877fab18e4838dc722fd1b
-
SHA1
ff80d60f27a14d55278fed3231aa3e7d6db4f669
-
SHA256
f420ab2d4995db26f022cd79a44d8b8633691719893c2d5ca932be4a8f2d7bb6
-
SHA512
94ea29c721adc71c17dd4a6f8b033cc1e76dfc498f55330dab3fe532a8a58fe55838fcdca60d228c137e6182816fcae8f02a481e88336fe32dc8365b97c23093
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415247655" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000000136cca728fb14fbd02ffcecf710e0cefbcfde752b1c56eda1c2fb5ef718d82d000000000e8000000002000020000000fc285dfa6c775d03eaf2af545dfda993a4f9efcbe85d5c74c283d5d56a45e9ad20000000259f1d5a32ec53e43ff1a0ad486b37ca642c05e0fb8b5531202a282ee57610084000000056143e09e5705bc3aed1e63c4a746d6bb929f7998e2ea0486bd6c5a8131006f858db6ec551cf5e0a48c4e5ed4de3006d58ebc5369f83e60f2c61fc3a70d8611d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80229858ea69da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000070c300340dc9f2e9e50cad33089c709e68810fee291d807b636e25e7cd58dbab000000000e8000000002000020000000f1bd2a17eaa95263a68557cb8dc9ffd8799afe729f6a8071be65cb2b5f090b0090000000f45e53e8d2e4d593300383726220c60a24c56cc2e2b4b93400934128e0844aef9c3b3a6746ec3c712a1a6a8a5cd645c95b08ee6b01b4d3fcc8322bfa27be64195e7620733d1aa7ef94aa87eece6f321be386575f01b9163f01a132a550a5588dc3997ebbe78cd220ab0e1de30d7dbf12b8eb189d99b4928d23bc86ac89d4f12cd51cdc43ea6f24c56b0e6fa36e73ddf740000000d6472b1962662d6a29b0f11e2290511d5af8a13c2a3d869f7174fad382f03bb64d74437ea1d3b0687f6f5a508e14a05a09ae45217c9193287c99ac5a677ede7d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83198AD1-D5DD-11EE-8C28-4A4F109F65B0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2516 iexplore.exe 2516 iexplore.exe 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE 1332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1332 2516 iexplore.exe 28 PID 2516 wrote to memory of 1332 2516 iexplore.exe 28 PID 2516 wrote to memory of 1332 2516 iexplore.exe 28 PID 2516 wrote to memory of 1332 2516 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aab8217b10877fab18e4838dc722fd1b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f25c77df18d024f3c5a9c8e9858336e
SHA16fb8be6b1609a5888a838b8b44b312a8ef60a24c
SHA256237373a8827eb4ab320fe1153743316d726d724830fb2b09b0601d28cceace15
SHA51202ac5abcf83626e7f2acfa30f545f0d5bde794d6ebef99ef9cb07e3b654ee952bbba3c7a40a1c6cb1b95af011ef9112e0b074eebd7d9735b116a78fd3bf81e68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c07c31934be47a7f3924f5b3e7015c6
SHA17d8dec62ff97e9ac4006cd09a96ef42fb02c6c15
SHA25634f1bd83e4356779a2ddfadee7fd3782ad926caae3156f9edbca2847252c98d2
SHA512631db262868d2e4bb093582bbef81c8228763d989309ab7cf30556090fac24aac450fcd7ef39eae55928a88a25946a3f2289dadb22be2a0b1296768219206643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55801eac271a7e9c0faaa0f548c51fab7
SHA186a7c693abb96738b53d944caecd803dec8b853f
SHA256f5173104bdefe917ba4f2a6a02e447d60da71f216a8a4c634061bfb8f56bfcfc
SHA512bb1e559aa731613814868cb38ef1f56c63e90ed41a07f7c6888ac8c89bd8a8796d1e141f0a3e4df1c888b189a47fe04186ebb21b46189f93afa7e8e538f3123a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5111c901f0aee2ad7fe12b98023a2c5fd
SHA1daeecf9aea82ca17d691236b06abe2414d23df8c
SHA256d16d34742e7711e7514c110fe35b034ec073e92f48f6da824fc9e02f2f971dcc
SHA512929d3b6269cbde1dd45b1e5b1b35f7d0bacbc91aa91557fa202a6e57eef69af20e49b26990382877e938fdf2889c3160223d230e7cc29f85d3c69b79b5e92a9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c207dc9392de34fd4b8616554f737591
SHA146e8e4872637890754215c569738f9eaf74abdf4
SHA25646079063a7b656f0c83de7793e49941a337537891a05e0142de699af3a8d3437
SHA512cfd74ffd975e78f65aab6f50c133371860c0a19e50e27d386ae4ec04e03112fe478e40020a42eb6f0e0b7a4c26605850ecf9c5e105ef2f4da608524fad5d05b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b812165cae629f9920fd48b5a858c3c6
SHA1da144cc1cc0be6357362f5ce0eb90191f00b038a
SHA25622361596f828d1cefab15e83ab61755864716d66613f7b0243a9ae7bf4d5b6fe
SHA51289357fd0a0898fb3389a4789848aad32b0c377b5abcb56ca874b68051f30a7455a809eca6da9c3a5845fd5440d1468dc60efbd18e692decb23d1532a4ac7d17e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578808f1436745e82fd64941f4fff347b
SHA15038f9794f39ae36f0b72c91dd510dfc9335e062
SHA256f3518dc01c593c1f5299b567119b6c2181400329e8081d5f36ed8384546e7426
SHA512e606b80445f0e98c80f6240334b6bab3b9cf8fd2622b1749551579fd2309dce58f0e4431c03dc13e31f6a7c57d5822f304a8a5f6c4fcf328531c04e21324e29f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9bf04b591c4f0c063d68d4567b59a03
SHA1126b6deafbbb32662716d78c89a289670d47740b
SHA256f984248fde6d9116f1b7ce6b95fcba223384c733d06d2c5d8eb7f421647189a9
SHA5127851de28e8a5c78e74ba06ec6aaea8a83cd083ff1e73c450e7ff11ff19c1e3c2ef403978862b1c3c118bd892924c4d5451d49509444a6fb637035a50b3fc6639
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9cd3db1e48507b5a0c7b2d5e34ea684
SHA1657dc29a49206de6d378900c1503c8b35ddb6ac7
SHA256692a1f6d5b7155a4297ac7b65b3a575540a1c8bcf6f81028b62e65dbe5c989d9
SHA5124c7e8ddaf42b9192e81e7631abe1d35c1187e243f9b4e01e1498db1ace8c90afd420b2c06bc3e8c4713f1ff2f84eb7210dc1d1f828db5cc640d0fb2c93308385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55354c9f665a4585ff367787b195bc3d6
SHA116f4e2615fb4b48b9c4cba83d297b781bfdc317e
SHA25648e51515098324b92bef36fa392fad4781a114cdf609a6d84773b6338bb7e335
SHA5124d76d5ec62ac7f88c2ef9a48444b37c17bd25514126abce070b24e552cf67126c8fca9fa03502bf6dc0ec43c0920ea02648ad5ad8cd1c9d267e8879e3050113f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a979078b0b899e241ac8b4feb3b9d47c
SHA1b8d699b6ef07a3c62eed15a83f7f82c443ac2b2d
SHA256cd23758d79523755f955a7ea682fb5f651d295aacb61c0b534fbf12faf16f05f
SHA512eaba072f1d628bc4c6d3d7f631cc2af288f3752bfba9f3808b874735232764caf67b1aa9cd0071bfb4907e07794369611ede139049dd2636a471becaf6f04cfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543b81a57e11a4e43633dfcfeb0903f51
SHA128831e11b08a1f923c5c86c16f88060abc08dfb0
SHA256f9b3cc53b39ac129a64f8cb6a6600623ccc161ffa8db1bb5221eecceb6006189
SHA512d74fecad3e84ce431dcce5276d68cfbfc526e912ad10a0419d265810e1c0d41d59c630a028a134f88c3affc894f301a4849d8e22f7fec6e5f2e2be786a429c79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fccb7f9dcc19a71f0b15d2adcae43b9
SHA10865677d216b17200750100ee944fb202d4b35c3
SHA256ebfcde2d3a383edce9d7f18ccbdaf5ed546785a7c69e7e7d4713b7394a892ccc
SHA5122a2cb0967c5706bc667d7c2310efb9a45f929a1372a5ff300a5bc5f73ca7bdd9167586257deb34d578f2e9e82ef2e08eaf09dd4d9292c57d50b1c2b9806fc389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547fcaabfc95ae4cd11bc213f127584c5
SHA163e2881083cbe9ef6cc6404187d57ed33234e88d
SHA2566b0ce51ab4886c88c5c7ed5fa0f3716699cc95b6e361c6adaa6c215bb62f4226
SHA512061a96bcb5d885dc745343b443c43ad832b8b53e33b8a4dcfa984e62e484bb14b2fa66134a4ca4199b13964a3e261eee3fcf1f8b9f93324211777a1a4d9c6e5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd4a0d26584927be0fc3670d0145891b
SHA1af8c0f871445fc2e2b167ee81cbb1c78843c8c87
SHA256328ef2a56343b5241f61de688c1e70fce8421cd51d751eabfe927e81d2a67194
SHA5120ad83d1469c5c62a8c1dc4f21d8621651d259a21472a42717267f54172f3008b5b8fa77268d467285f7e52e17f45b31dbe7840b8b2fd190c0b841c3425e38775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8fc53c02d68cc370db48c9f1981f81e
SHA1ffe12449f0eb5a32db3d5e8f1affcfa560f5681c
SHA256cf47d080d2da33451b7cd1f4369076e0c0348cd37aaaa8105c45d24b01948c54
SHA5127a82099d7d9ea3d0393c2d4870d2efc7a6bd7d0ea7fdd7a5a0b6b6e81cf3b4187587a45adf4e3b6d4942900e1d851a19dbc891d825862bae672601666a36df71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5802699927f1c452b99d61c0f4a5bd958
SHA1a3d07ae8386394a990d5d0ad998e0707d166e352
SHA256bac90853ce85f3b49153f8443808447243878d414b9ccc635edb61fbb5344914
SHA512312def15393670c0afb862ecacac688f65956391533152059cdd1fb91487f9c3cb4267e907ce0e833cd74570f779986b260e67b007c9f788f164cc8c51195e8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dfe035a10e3db5b6cba3500d8556892
SHA1e1b335ddb0359462fd47f189630d20169b39e2fb
SHA256bfa74022975375d63b76360bf6d8b3ff030ad471b4d62664e62d9511f922b6f7
SHA512693cc9bfaca20a0a09ddb8228ea88dae3d8363a5405fcb1cca3d759938bcfd764cb6755c9d7fff04f8b5401b0df744cbebb34c87bbde6d66a9b023c106177078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563bbb6337f0d798849a5dcee127d224a
SHA15078771b18fed33385f8937c3220a03acc90fca8
SHA256cc38efdb404be7670d80fc8aaed80898fadf74bcd481c7900734aa9e2cb77226
SHA5126977e87ac03957cd0245a1eba623a49be41edce35fc758f7db98d96acea3ad579247267d41bd5b622f56706ff331aef5ac2f9a5932f0ba4c3776cef0015a566a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63