Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
ac1af946d47f7a1756a26b8c7ffc8040.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ac1af946d47f7a1756a26b8c7ffc8040.html
Resource
win10v2004-20240226-en
General
-
Target
ac1af946d47f7a1756a26b8c7ffc8040.html
-
Size
184KB
-
MD5
ac1af946d47f7a1756a26b8c7ffc8040
-
SHA1
7d6335212052be58f0b383de75fe9308e9562705
-
SHA256
75b6037b5b9f32152c5ee4217def9cf3c04481b67452ca910485c648275eb99d
-
SHA512
b7a01c762bff781b015f20a24d84c9f301f84d8d831d781417df31cf68234373e765c2ff6d213b4f2c7d57b47ea7c57125b0d1ceb94fc770ed29c0d323de5b76
-
SSDEEP
3072:SNhyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SNksMYod+X3oI+Yn86/U9jFiM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003f64e16e0672d3f6c1519b68dc2d063c33341d10dbbf730f596718281af15461000000000e8000000002000020000000a65bea6b7bdbf8b92bf03870a632725ea8ff7dffe85a2bf9bc896996a9f2978920000000e77a7eaf6b4efb3177dbd35e7249de145cc8c527719b35d5cb0716255b4ad74740000000836c4dd6c7ee832947bfdff23348d3563bd64d681c72bea6a3b064977973811fe6501b4800b51a3bce3783888d5b8c9f2503ade6ddc863fd4d63db438463c6f4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91C728E1-D645-11EE-9201-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415292349" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001ac6a76b66e6919b4c6484c993b168567c99268acace27d4a17fcd452fa1e15b000000000e80000000020000200000000e9f37fca3d73d065b48799a74fb14e31cc66fb35fc917ca3060a5780e6ac96d90000000123285293de1c7d387e6f1f161acaf9dbd20887cea844117b228e8cd6c5f1c9daf5bf3488a03288f17800d8e9e3962e4fcd5130ac5d99b0f676ac928cdbe8b99a8629d2cfdf0d191a4e73083b412dc10e03944fd68d6eede2faea3d053c4f6acaac71993952d4e0536b727398c70f02ed418f3e8d11c0eb4310141f9cd6493491838816763e45d494af766edd86e9e1a40000000bf0ce61b309bc180e4531ecb1e1e301fd01c54580f5c031964a1e1ff294919875d9f7e8f4fddbe596b569d7adfa31f005130085c761b7113b1c5faf56822f428 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0bb1367526ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3012 iexplore.exe 3012 iexplore.exe 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2940 3012 iexplore.exe 28 PID 3012 wrote to memory of 2940 3012 iexplore.exe 28 PID 3012 wrote to memory of 2940 3012 iexplore.exe 28 PID 3012 wrote to memory of 2940 3012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac1af946d47f7a1756a26b8c7ffc8040.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b8ca005e27cc5516678bd23b545926c
SHA191070f08b163244ae6e36e9420ad6905d3babdd4
SHA2568a77c539b00962e3882954bff2caca67490671ce3a122cb466a29eaefb45d978
SHA5123d8a6d6cb4655400c912afa0ecc0e6a70097cce35dfe606a365ef074be0a4b10efd36287117096f7a1e61d0293008ff6d1c8db7117d55c60530d79be89864aa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5770d634aab402a4599aa822f65ba940e
SHA18cad90698169f0871327cb853d8f83349d2b0b1b
SHA256013855ef370e891e35d2957bf0ec513b688938c85fbabd6a60e2097482ea123f
SHA51252b2b74ce862c64eac243b0433cad5d2da5bc2a812916a47f48ce5038f15a81ef7603120415da23a67ffa50cb8120c1d18092c75c96c0c2d3974267daf6a1b88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c99aeb628f4ae69ae91d1712431396a
SHA127f945d2d6236b9a9bddeddc209a0daed37acb8d
SHA2564687afb48061d6114162e4fbb807dce234eed14fe400bac76dfb1655b12105d9
SHA51270509131f71e5ca654f03dadbb0178d7eb190e732ab26fb81f2a8e5a5979152ed5a2319865ef8be8d110d9f9d7a881058df9271b8114e24c092eca8638902375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b591111eaa8fa1b8058d68253cbad2b
SHA1dd369442b1fad77fef4ddf2c6f7ea78665ee1a3f
SHA256cc6082a25e07b3e74b11d7e32b2013da829e412d33c2ec4fc87904de14bd18b9
SHA512d1b65fd9dc58817bf41ed6558228bdfce4d9ae20751372c42beea6bc69f3f60f80f996df41b5cada70f4c923bf1cef09d9b357dae94f572ff45be3ea033d8d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf67150a8d678b0c7fd767d9d03581b8
SHA1e0d3f7224966cf6ab728376f716f140e52b98696
SHA256361c19675401f7bedbaf8c1d485052131a5a4c4187a5be5bbb675d2ff5db850d
SHA512062d8dc3a24fbdc810b8b967c9fcaedac5b2461e0b444ab1f2e9d9079849e301095f23b796a59bd72f91d2b7f7de68f0629ef91a2dbf277079705702f9886835
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fefe87d4b4c5c1d6e1f2bd5f71156a7f
SHA1882cb79d38d5a9ef4a3e76bb3af0bb2d38fd294a
SHA256604c814cfcf9d1a1447a5552423036076bad0a7598bc8b3cb24ecedf5cb961b2
SHA512a646b69f8185906661c5da6992ed0215ec1a84da6f9f595373b23a450491e1eb29ff16f90ef8343cc0cfd3863c784271147c9f42788e046a056b7c7a3fa63833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58150efa9bbf94ea179b244a5c5da8db0
SHA1cae5c8ab25893c7872aab99e27873043a65834d5
SHA2560ef0db98b7dee03c487b54a0c52dc0cdaffc4adcc064c8e7e2395c5ecc576c16
SHA51274d734da59bb21df08142ec761ecc6fbfcd2edb85964ceb04641f3fb0b2f4704785b40e8e9034977da41ff0dd3d409ee1a382e73dea1d4149460d250ff74e0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbd5c12a964353a9bda1182b4735be22
SHA1d9e54999780cdd7467d3dae95550263420f6b9a8
SHA2563066ada46c807bc19e95a9e7bad1341ad7f3b1d5863e10ef89a7b0ea2a18052b
SHA512daaa9b663f4fc070fc5e20e28422eb00db407af0af77b3ffae81ccf896085b154753c458d2586c524515568ebcb399e1d823db39b4b469200b862ffd95e8ba60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51afb1dd4630b2213a53a5fa9d90201a4
SHA17ecde4118a98bf62791210742d213865ec693c4e
SHA2561b0014616a27dfb7111d3fb127f27460567a455c259be54f1c99f79435a7b2d2
SHA512d863c89bdca3c6fc4ab933475a091ad534715d0df83e76ba4de194121f4d18af833f34309e87a69f68fc228788e59e3df4b53e6a7b06ef59733a82e1ca81c144
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535bb58782a08d2977defed83358e667d
SHA1a0020c768c5563c63e729f3af732fc17e12a725e
SHA2565100187c01d160a92dacee715136a3927e396ebc7d9c1943ef3974ffd11b5ecc
SHA512e04805265fd6c3fb9fe838b889ff32afcb5ac32d76b4112361f531346dd24a8121b0711dc725a18b09e25aeb9b598f47c52ec5e64349ac4906950b799a625b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4c079de26fed232a3e1a124b3834b62
SHA1702c2f99545a9a462dcde2df2d270d4562f92ed1
SHA2568c7bcdaabfb61ad6d62dd773abfdee1ff4e443d2e32efa68c0ed704c74cb9556
SHA51251053b8cf8e69bf538a061a319a06a0f0fc7d01b6ba39153462b9a59805d5ece7f18f3f7d27bed8ad1697ce78a9a4d1fff67e197ef3fb531042062f56fd766b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc762af8abd30c9ac9c2ebc904ddc110
SHA11c5afe6bc48110a6971e18c0602e0cb845cda27a
SHA256259872200a36a5201bf088a0dcaa24c840965dde37e94bf2da6a0e0673dc5fe8
SHA512c09978d6a43c363148f7e2c427536d138a3d0d0ca74c34d6f31924c5d3f280b046015d0a93c12f12662c3ca07b835ae293117496c048dde0b68e4a7d85f0b24d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea3fa7791368b4e658395dd4e4f5968e
SHA102de4b40effad17a6561ee8a598e7a0e77000ff8
SHA256b9054c5d74890ae5e0f5eefcb2c927c22ed0b8d2b81a7af3d57f5afce029b204
SHA512df08eca7010a12f646954d2336382c0d782a0e8a2e56e4256a89feb0421e07d0d6cc9c339845ba6d3871dc8c1f6c3dbcc7b8d75b56e93e6a4e9f0456e6a87c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55415c91d1221b8e0edac7817ee453dd1
SHA1399cad049d1aa3adb6945ea522a0b8669b410f66
SHA2560006ca0e926e33f837c36bde5b1d279217dc4085d78527c48cb5881edef179bd
SHA5125d10040f8018f41f7b23339ac3e6c9fb600a005c34286042b4ef9717277430046d0aed6d814729573e64e60918e5004864ba3504158d17586abca341d299ddd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8182efbfe5bb7ddfebba56d1cc360df
SHA1f039e8cd85143bfcb5f2d3cdc1c6fc4f27d49da3
SHA2562730e6bf706469fadbf37de7df0c42d801fbc4c50b82429df78c2899d7e0799a
SHA51232f16d896f517f8c4cf7e7085a5352fa5e6b748390fdb8009233e3342e82688d404d7849ab23d356693cfadc2ec7d295154d9ebaed7d66a8212a475535592d95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5918c6cb63cc818c653db17e3a34b2c95
SHA16a5ea9ef7f806e51c7bf1d7d5735194717aab6ec
SHA25653038eeb5f4da53360b80b36e0f64cf911e3656eaaf1d9bab26a139466795d2d
SHA512128c97973c22ce4b0aa250d1ccd8bb2d4cd7086d56c537b6803118ed36725d1471db6efec1d2345f39b6346bdbc133cfbb9fe0ad4ac9393d43601e36d776d23f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e28b946935dfbccabdddb9530d5c6aa6
SHA1a53a7c41f8b937388b999f56bd3ea99e54d619d0
SHA2569efbafd068fdae29cb892b23367ff0bd0603af75ca0f18093ad6dda037fe6238
SHA512997d814c33c182aeed1e49cf5d6689f4d97ae2da305184f95ef16f3872822766366cfd0dbb282ec23e8db95863964f2793b0223514eb00d8249767b9c8e08d7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb5f52dffc37af8faa6ad4307c6ab374
SHA1ec91229540bd2b398fcc8d595993ddc16cc03f51
SHA256672aefec51e0a5e60a3875d1d16dd76e8d31088057656e5f264e570a9494c40c
SHA5127f036a09baa8dca28beceba1cc44feafa4e00f7c350bc32781edc99e08a867eecb5967a6108e921cef087c7f20cf10ecb524a01401c5fd0f4cf17401a519a243
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63