Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 09:01
Static task
static1
Behavioral task
behavioral1
Sample
ab827147f04d4d58e351d78a43efd8b7.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ab827147f04d4d58e351d78a43efd8b7.html
Resource
win10v2004-20240226-en
General
-
Target
ab827147f04d4d58e351d78a43efd8b7.html
-
Size
34KB
-
MD5
ab827147f04d4d58e351d78a43efd8b7
-
SHA1
0c34fa1f802971d633c6f311c5e4a2f48ae91959
-
SHA256
3300a257935179c856bf0b3f682674b2069a12ae969140418aa024e13de418bc
-
SHA512
00f6fb909614d7682b5e49394f4eab1bcfd8592e163d2cf0cfabb6401da0cce877bd3031fe12657ad936904d4e8feb8c897534cea139aaf38a36e46d30a4be76
-
SSDEEP
768:/uCCm/BVcSEwx7Vo56kg0NccHRmR0JlgSW0rUrDouPGlOGpeGYF+TGRH9mDru9C:/uCCQKxu0wJ0IrDouPGlOGpeVF+TGRHu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000000c37b52f08eb00a9ee438bfd87f3a1df75be1e3630c84179346b1e66dfacc608000000000e80000000020000200000005169e4546746f8e5d0c3f995fe2c2cadf92243899d5f7740e6c081f9145850ce90000000da1ca772270f02f56618e911ee98e36cb8f3d2ff5a293b3c9352b5b0e0d6e0d57c4d56c36a59d4d28416815b488b7b1d60b69c5dad97bd14bad4611741c73d27d9ae7f3ac4d94552499ebe3a11afda627cee1b75704de785f9654c8be7114ebafb4dafd0c23fafd66761fb287ae799f59beca787681c932ebbd71fe4d967a582e76e239df0e25fc85fdf107a61b5313b40000000273fdf343dfa8057dabd9966f8a148f0b1a30f9b02902a42b32110de02741e82690368c6555254bac72a20a87f7055f980365abcc069ccbca74669d32c4dabf3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fd28d9246ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415272779" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000001fb5dcefdc619c37f89d45dec753a03d971dbafc17b0a502420f3ea2a38a8889000000000e800000000200002000000092bceb005fa1181758b2eb9996f3dcba28394d2f626dd8175dc6a61860930eca20000000a46ca48e5e6d037ce92791c689be22fa99ce111f53e727e99dc6ec6a4d36a55d40000000c6c67515ed49774665f1c3506145ed485c85526eafad2cf95d83a48fcfc5536fabfccf616d6fe4d056b44f08d71abfcc06a69cb318e83423a662d870c0734c71 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD0BD111-D617-11EE-85CA-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1504 iexplore.exe 1504 iexplore.exe 1576 IEXPLORE.EXE 1576 IEXPLORE.EXE 1576 IEXPLORE.EXE 1576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1576 1504 iexplore.exe 28 PID 1504 wrote to memory of 1576 1504 iexplore.exe 28 PID 1504 wrote to memory of 1576 1504 iexplore.exe 28 PID 1504 wrote to memory of 1576 1504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab827147f04d4d58e351d78a43efd8b7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5705f3a645ea5842b9b6b22c675e55177
SHA1fca7eb6da0117247aff6bbccdb4bedc242e30513
SHA25647cab5de6761e99d0bffb105f321bb2a69914b0e63f380a03cbc39e786b08663
SHA5129c37e0b1be7a56f62ba4c2201713516ba0571a27b4c8768aedfc3a5b3d6b8732a0033375a996223331c4e3a49d3b3188662837cfe5ef701e375eddea64322dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd74f56cd22743257d8f5144e309999e
SHA182cac1ff93e15c815f2c6da7fe669379af2a3e7e
SHA256f0f9ed430cfe90dd8e86d585ef8ca1e7ec76675fd479ba789a2a69791eb50134
SHA512be6dcd31d670f2ce5466ce0688a39301625c15833945859abf696f818f094a59d41d9cc4149915a2ba3406cee74cdeb082f9ebbc1172bd70a12515a941a5a043
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a19d670398beed9b4cd25c18591176c7
SHA1310a143d10e382e494a333ab2e187d18edbe726b
SHA256415d3f07707261368f8b526fe4f630a3b23ea70516d5067f906ac66dae6d7fd4
SHA512f9793f44aee5912659798a210d793f3ff58906f34fe06b199b0ecc702fe6a1ff1b6b85bc55cc16037465f55361acd5e819e355964c062958754b1bdf6d1e8987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc6eda3d2372281bc662b9ac57dda9af
SHA1775915f34137228393005b31cd2c10a77725f5dd
SHA2565d114993170a8ca079cdb9cb8d5016010fe3c0f28e84147c8eb35de007b4a8fb
SHA512b5fe97b9f4d58a88ceb195c1203c1bc123cd3558ccc3242d620f40bb0275b5f0aa7fa36a9ba17bb70c155550161fb76872a1ab79785e1165368cfa684d0eab99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5892eaea68c38926a7dee639962bd7def
SHA13203305965da5dd440c37d74a8238b9341505b90
SHA2567ba29bd2d9449861261aaa4d84e6d5c0d06e29216a0e97aed02b97cd75486cab
SHA5122f7b50793245294041653d01f303db95123e24df181cff54b3103f34c58058dcb8b1f1fafc9470a234ab92945ab7bb05aa41a64ddcd26831b050447c75e7e552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c35b1e865cc061a405da5859e8ce9d32
SHA1346f4f0299ba307fd5e567509dcfbdb2d1a44fc7
SHA256c12a82f7d0e60032adb5250fa8724096415e5f438bbc69d680810fd80c0771a9
SHA512067030dae208cac4a569e2a03f8eeaf397969b31553dd4fc76cc6461a355bdc1018299e55c5b405ed68ebcc41d86e3562de8782cbb1549ddd9d3104b1a75cfa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5a4b17ac5971c8e98992867d044f903
SHA16121d13b9d0ea146b834ebacf97dda38a565a9ed
SHA256b787ae72ce76c31e04c0d4acce0e7cf8141347931a33780463860bc98438b691
SHA5120d53d03c1290a4f0bc7c96ee3c50ce592c8e6ad31717cf1344d958f02d84676be845b9d5c95437e162b3dfe4155606b8975f13fce5cf302631d2a023693eb23e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23EIUNT7\cb=gapi[1].js
Filesize179KB
MD54d4e1c761e3b8eb804a71cdf093cace9
SHA16c17659b5b7782edac52e8d940594a4299f160ce
SHA256ee0c655ef27e84f0b50811b4d851be3b9a1177c8195f2060e7249c9e100daa81
SHA512974874a33feb1db1ca7a4e7f000b76526c511a65889a5bd1b8b2d131e3b41902503101879756c87a0b1020dd7f299c3ff1de9b19f3c1d21e352fe5c0bd66b220
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IT88KKGO\55013136-widget_css_bundle[1].css
Filesize29KB
MD5e3f09df1bc175f411d1ec3dfb5afb17b
SHA13994ec3efe3c2447e7bbfdd97bb7e190dd1658f9
SHA2561a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617
SHA51216164d66d452d7d343b1902fe5b864ffdee42811ee90952cbfe9efa9847c58c0403f944c8e29db2bc2384ccd516b629cb8765e5e51de37da6efd75962cf82530
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ0RD6PK\cookienotice[1].js
Filesize6KB
MD5a705132a2174f88e196ec3610d68faa8
SHA13bad57a48d973a678fec600d45933010f6edc659
SHA256068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
SHA512e947d33e0e9c5e6516f05e0ea696406e4e09b458f85021bc3a217071ae14879b2251e65aec5d1935ca9af2433d023356298321564e1a41119d41be7c2b2d36d5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ0RD6PK\plusone[1].js
Filesize56KB
MD5b9dd4bc0c774f6e47fc7f6f84318d3bd
SHA171e659af69facf4538bde88422c6ac7574c3bb5c
SHA256e0f79422a5e14ac8ca345540ab58da18651216e375c4fe02143496bd9dc046dd
SHA512419b21dd145dab3ab4b543c87fad7fed6281c2300ac7f1cfef1119703e5ee97930f1c07353b2a1274d4879b481bb673ce3566306c9b0b91b1e573ee43486b342
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63