Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
ab43e6067a6ea199c8fdd33c04c50f54.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ab43e6067a6ea199c8fdd33c04c50f54.html
Resource
win10v2004-20240226-en
General
-
Target
ab43e6067a6ea199c8fdd33c04c50f54.html
-
Size
14KB
-
MD5
ab43e6067a6ea199c8fdd33c04c50f54
-
SHA1
b630d4a5375215b9b1b3b098aa64fef2a26fb37a
-
SHA256
e4f504a535ce8f6a27e666aad8389bad0e97fb6919c24a569d88fe52130b5218
-
SHA512
c211d0e75ff634ec0943b37a7ae6191f4c808bade7ed1c719f4995fd950eb9b884ebc28c923d6e98be21127f335d0e1159697e96a50c037c463c97bb5499ab5f
-
SSDEEP
192:MsI/qss23B91RlBz0/L9JiKBZatpbnTAsxYLR:MsIisd/nQz9XBI3xER
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415264769" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0182c31126ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CA99431-D605-11EE-92B8-52226696DE45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000019a801d70ce59263ea073c4c8254644c32aac39d4c58f7cb6e7ee71ab372ba12000000000e80000000020000200000008a4bcb4b7366305fb4fdeecc4776de7094a7619a0fd0957c531a1c85aacaa58620000000b6af453fb4bf52c638f64e5377311afbc50804824910a7b3e9bce95bda0ad6264000000076beca5a4e546e583aea4f04b862ba5c01916be58d2e474594185291474cacefa261c601b340f0164db8ec4a47117b1af453279659c98ba3b665102a0884e1eb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000096c9a42c43025ba6cf8a4308932e48175a047ed9d901627a182bcf9aee47c799000000000e8000000002000020000000d881727406b57c4c990f659b57bdd8e4b1ccde4f1fe77df28994aeb26e3ed4db90000000f7915f9b2673a9bbd0f41d89153093eb1aab265abb05098a1d7bc95d5859baed6f1dcce4ae1a0feaf4aac8e0ab5bd7382f269bd90ab47b8d2d5aa6d1027c925a2ac880247475fac0a4f90ee39f5919b939551f62c69315a1a28dd32c82ee5b821016ca53c1b02edd6e96f1a51d487d80fb73f15dad34cdd1512513fb5b269552d7b76bcb51c5ea591571fb669c1f8d464000000003b46efe43fc4064ceeab5091747a339aacb04cf3b0ad4a2c31ef2d4056749a8b44616b1c39458fae49d14d6a5fa936c8569e2ed01d3fad222250ca779e081ed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2768 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2768 iexplore.exe 2768 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2712 2768 iexplore.exe 28 PID 2768 wrote to memory of 2712 2768 iexplore.exe 28 PID 2768 wrote to memory of 2712 2768 iexplore.exe 28 PID 2768 wrote to memory of 2712 2768 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab43e6067a6ea199c8fdd33c04c50f54.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5c6c86b87ae0d10c11d58d648a3462b
SHA196adbbb912d6fa596d936332ebbf4f91ad7bdf40
SHA256c4c6366122c1bd291a7fbc85a490df134fb115e727116f315df96dda5f6122d4
SHA5129f75c9af18df61cf1ca42075b2b137139244134dad58062b6e4c20ea82a796045ac29215c9239ac1f7460d75897dad70816ce8db28e819d1bfaa24ceb555eb32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533845db16d0f7036f960c505c78fa63c
SHA19be42a16d336efafe3796baf30e99339680fb1b8
SHA2563ca215597699f2d0098a39809db8be466fa04b684feb597e7bcd2496bce9e144
SHA512b3c31ea47b5e5efac5571ec46611473f8ca5e4723b5a1cceb07d6f743a4968dafa1078b87bd7bf97ccffdd78036cbaeec218577ff13f2581fc945982a0a416fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e72fa33786779321c03c59c2ea1487
SHA11a885266697c1f4426a66c96bb7f88c817de6ff8
SHA256d89a58d2572f20e90df857d76074f3ed7fa59d1b6f84dd9f0b57bd134cee43e2
SHA51212c800d17a5d2b0fc5fa1ba254626855be218723ff0faf57de17cd6c229f977f492f4f96637487a11675e4a1c3fe2cf766807fb8c204d9502558f7848109faf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a417c659ef0855355464ac885225b8f9
SHA13ef52926fc4d05ce7c696ef7de3a6a944ffed84a
SHA256c5c98f0f11a10f7047ae7fb5d51e22a4d95fb4b680c26ff56c45bfd9b731ac80
SHA5129e546a58193c7e9cc8f3875305383e41f2bc8ecc1729e3f79b22c19fcdef219adf07b759c60b1138fc06d2239d26d384204902287a88b15fc024fdcbe536add5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5597cbaa525079b2ba05efb224047b9a0
SHA113fdfb3aa0cbb80dd9132ea15c929cef0d978dd8
SHA2565516c27656f469d291cdce4872b4336b1c6a924b155f5bf1b46df9e82fa19d2b
SHA512976c443477a84c04f67e2c04f2496a48a9beef266ff4377f6ca4497fb589ed8b1e20e3fbab328b533a64a2941e3cedc10e86529537ed05c304d733455fba9504
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59639f4f65a22cce2653ea03c0d0ca2d7
SHA1212c03cc71cb5741edaf4ffe4375c09eb0d3ef1b
SHA256e994c7cb03a19978692458527ef508ee07dc697298787c2836e98d0aaedb8aef
SHA5124de5dd7700887f60c8cabcf15512db4857a85290f3e54bbd764b8f0b71ceb35445666515b9d9f557713291774863fdc8aedad76a3d6650c8a1cbab02684de582
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d39fd1b968fff39369bb11849aa6ff8
SHA18994f051bb2270c90034d8503b86fe8a23c68fce
SHA256c8bfca4e593e7ae0884492911ebae7d70009073ca8fd567e8bb5f19ebc7b5636
SHA5123c25f031437d7294d26190945da11bb57292726951e2bd63d95d6c15fa4bd69401051c1657279420342b16d57aa58f71856d8c8e2fba2f4ab6c75167f99ac9ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575ed7d75e1fe8e051cc4cca3fcfe2ef6
SHA1edf691994f6256e2b4422a478c34af6f85fbe63d
SHA2569ef1aa56a0867657c24ac03c668510ffa1a8ab3b93c7c47af6f4ce2acd71a885
SHA512712f817f402b6c38d5be30e819f75e683100fb9806186b79ddef2b420c87442cf5d35fd0b6821be863512dd91717ca484843eec0a099b72c688681e68a0fc54c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e646a606e7d7978ec958ec75086e4f98
SHA12566ccac5fc1082be705e6ba849525fe140c1e2b
SHA25673582afc0b561c84c1e1c48715a0fd3e974c5347fef7bf982af2e63611e3ad68
SHA5126b9d2a35b15e5124b53d20fc6e2756a022fb40e6ba1f328dc127700c5ebd29a93a49bb21fa023b4a070659a9549f60ab7a9c8849d2e51ff7c3601b7535ff76fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb6044591bae5d18d130d33afa1392c0
SHA195b199983ae2480f65db3b6aca0c75ff64fdec20
SHA2561c1431607ce28381cabf2a882f60a7edafda4a53885c539e7d9010ef47e9d9a5
SHA5120b03c8b742588888c526f64b479956bed482cfd804ca41cb32d7e295d68aa046189ece9915546d4fae3892a05a6a0c1bb54375996fefc610e341af32774074d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5175d2f31707efee3952f920d342df610
SHA1029e809784a02c6345302e415faf34a32118b740
SHA2566e8c2a7ee2508c938a75c40ebe49679429eb0d677ac391a1c33cb0b5d3a4c9e8
SHA512ba2a4b35d8e25c896488f08c346364faa5f4a0635e9073f0e32c0ecf41c70c07efa7bc2939ce1e274af621ef88790ce42bfd4497ba2b2447ec3552496d014954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9d8d75e171a27c5ddf62ba7183e43d8
SHA1b94b9f5bfd986d46f36fe4fd18a912057b3f8ae6
SHA2561559acc1f1a02e9859bcf547ed0cd8b8ac0318c8d53879f74351d959c669047d
SHA512536076e3f5c2be5e08c05f0343b3e9d12f77d2da9fb948765a4bcd240c37e846217b971b6b50a8759621a0fb6e6c0a05cdbd3897d3db48d20d1db26c3f1f8457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1f0a8b3278566dbce7093438997e3a3
SHA171a7ff63ee0ab26b10fbdd8db712aa7725b9ec57
SHA2564a3c1a482138292b0361683dea4411873ba0f34d3f88b08b079b723c4b503d5b
SHA5120f7d091d45bb02c06dfc81170e84e1309af0546e2e254c44e17a1a2b37f58ec06204b1e988e8b13acf7073051ae241cf8372b74cff796ca0ca7eb317863fb8ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b270406c4f2f5c0d2a844e443547b4c
SHA160049ddb7174273d9641abedb1344827be9dcd79
SHA256718bd042380fb4541b3b23b34a04ad98780c019623066fec97bfcf4c2424ad25
SHA5120ba90d20694231fca4eb89837393ce11f7074cbf3b21322ed8658ebd246d7fcb8ca49cdf95ee3c2bb96c69bb2687b686c79263f0bd69aed9774b1bf6c21c4730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd13ab709b89638805e3ed7c93cb44bd
SHA1477c06d806f7f03808a37a965cad406656f712c7
SHA256e7753807bc391221f6b81f5928cf15b23b9afa6ec2384bbce0cfcc0e9e45a01d
SHA512e1c8a07d86b696e92f7768cad570cb9f0f5ec4a05037374679a0a435b3ba90eaeb952230396aaaacaeb9ce2c28afd17fc3d0030a9dfff0b6e46df48823ae2535
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b387406be83258f94af38b109020c9fe
SHA140215492e6d16a5f517c22303788f54242b82ae9
SHA256369b4784edf8e155138e8cead9a0dff0eca07b4ca0a710a761036c325b32801d
SHA512e0c4a08b13328d1552ab11d957a61ca96f246d56491dc905d7e394c7599084e5e522d3b426aa5ac2dfe2f977e0b3426c768e794a5f0c3e91b16a1b2e7719e80b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a02103251bb656585cdc19b16bc3ad1
SHA1a31132c145d71db6b6dcedb14d749d3ca39509cf
SHA256c21b84abebb9d551e486849b1c3a067478675db6b6b47b4e4e8d1fef22ac0f03
SHA5126946250859d73da29a7c0894af429f097698f6733218b3dbac4b749ace8a0c9db8f00b92287d0f27738c2ad9873853f186a49f8a61e7668a8a5f37dc0518b519
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63