Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 06:06
Static task
static1
Behavioral task
behavioral1
Sample
b3f9138296891dda5071e49b5eefd9ca.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b3f9138296891dda5071e49b5eefd9ca.html
Resource
win10v2004-20240226-en
General
-
Target
b3f9138296891dda5071e49b5eefd9ca.html
-
Size
414KB
-
MD5
b3f9138296891dda5071e49b5eefd9ca
-
SHA1
e67f31e3530275e1c21c9b629861670f0047fbdc
-
SHA256
829aa00364f452891c169d790451765e86bd94467229a170bfe336e26528b4f6
-
SHA512
44a3ea35995bf8bc5eeefcac6a346311a20ab799ff0c9b4258bb63cff0ec9a8ff470453e4233e0fd85e6602c9a493dde2b88a8a1c47e301aed13dbcc737ffef5
-
SSDEEP
6144:aEv8p3qoOkVmhulehW/s0nsvk7qpdEU4sgDvpJakBCBukhj2:Hk7OkVmhulegLnCNposaJXABL2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000a9652023dec7a98c9e59ba043a0924716e268ce81f18c7e392d310df5b2e62a2000000000e80000000020000200000000b2c249e32507d698026a50507fd97d8c42dcbf376bf69ce69c2e03493fd569090000000e059ec9e58a0e28cb53cb0fa2a8c9915d6e4757aed655aaa98312d9a1844912eb3f9c1e5d7b12ac71ebaaaff8de204259329bbe19f8bdc141bffc7347a22c07525ce4132ad9870cc6763444642ca842d4dc30dddc51942fddfd61123f1dd21812be7a66a7710ba8f1d8416eaa796b9c7a4069c540e94bf5bc92213e53b6ca7658df7c94ff6ec7587dc14e5bd7ae928d5400000007db39d0939fb30a70d29fb43f8610050be45d2624e6e842908f1e387fc962ecfebc6ecf1dc0dc06e7037131de941d94c6309c297c86f837caeae43defd6af2ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8046364ac36eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415780636" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{749A7271-DAB6-11EE-9587-CAFA5A0A62FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000df99badf30ad8824090f296650be875c1e0b739180984322249190dd4a178e1f000000000e80000000020000200000008eee2a427012c01ba6c6881e3e591adaee777b0979ac11eedda14096f8d0b29820000000e44b4288bb4f81c3c988e3446b0facc3390edb76e1eaf47b577aba059a1d556f40000000101a3d605577ca21c87b6190e0733e172338b35364671b73f7e33b5b4ee55b445bf9dc323cf65ab7790b23471111fd68567a110d6a6b25f08eca83c3ff975608 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2188 2020 iexplore.exe 28 PID 2020 wrote to memory of 2188 2020 iexplore.exe 28 PID 2020 wrote to memory of 2188 2020 iexplore.exe 28 PID 2020 wrote to memory of 2188 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3f9138296891dda5071e49b5eefd9ca.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6700787b1cafaf80318fb961fbed499
SHA1ca3e64c19f94e5b8dabfb2f277eba9c96070354a
SHA256fd4ab5fc6560be87845a34123b7a6dc27e9b74ecd178dff4f6064788b1ad9813
SHA5125003ea845973c40b73cf473398e60b18235026c552be2387086820b51639ebb26ce4ac007b1aae3f3e676e2d14bb84e7d2a0bada4050825f0ae3f3b4d1dc93f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578b272681d6c52ea47133f115a768b85
SHA1c4a1c289c9c2164fde9aabc0c5939d3d685f8f15
SHA256f21bb81c9bb64af614c671cfb8a9ff05d7d5d3b2090c212544f7e20d665b813a
SHA51217e5648cc3fb271770d7b5250cee6ff64b442236398532a4d117a39ed8360c091a46a327166c7ac53b80b17d57d55a0206ab2ae544f14473389166f878b29c0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc2cba406d3e63fc19d6ba7afddd3b4d
SHA1600c0bf63b05fd20207f0a79da741393a21d1754
SHA256d37507afed9fbd3f8aa62d53db68b3f60af98c94e8b3c997f42af24196809e62
SHA512b68680243b784c2cf66eb37770ac6cb326a1326f16cd51f489cf6e66a4347d59a27d04ffac47a21368a35c1fa69f27a80ac03775daa079efdd88b76b8412cb27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5334a7039d07ad887efd1057ca733b476
SHA1fdfa6bc8a203bda35bbb843d93e2e5a2287db1e7
SHA256c893ba92c2dacb57b4f2c8e36bfc8be651ef1c02ed63889137f07022ce8c37a9
SHA512301d46aead21b16d8504f05eecf64ccf30c05604aec32cc43adada78cea9dfd82308595c839a5bc3164967250f97bb6d0347822e1eafb4a988f09021c04914d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58240a8043f55db14333fa70421fb6cc4
SHA1551e1a7a8bc32e0d2870a30608179fb4fdc9b115
SHA256455d05ee6fee9e3d2cfd3a6bfda1a66a5806f26b2b49a8bcf2ff40a25b670887
SHA5128ab253df9d56dd18e43eaafe0791b396c9e116de3167b78f4d24d16720992ae428019fba98fb10786074c0a88e0942828ee269fb9e008f6a905adfaaa9463864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58102669117f2463837dd1c3ed92ad8fe
SHA1331410c1e441ec1dd9e1c4ec19334482d2e0d56f
SHA256bd142b8e3bb597b015f896508626137f7c79ede6897412ef84d83100c303f8d9
SHA512ec1d8c6bd1c0d59e83771441509260b89b2af1c80f620cd06af1e41b1bed2497157cfa6a2fdb69c1583a380a4e498d4291f46efcc2973f231b36005c1810f932
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561c85235ad20233811510052455a8697
SHA122d149aaff43a27fc2ad54fb8d8ea52ffa2ee457
SHA25620cda67cb3aeeff59dc6f352ef77e8a01e62402aef64881423eed4ad4fa3a3e0
SHA512273e60c8d0983f506f7cee94521fc5d0704813f70e87f0e61bdf6703f75ba779ed8e7337f8559338b9735f04b0f187b11534e3ba299ef23f878924d738611e58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0b390cd820b31e5734c4e0a1e057ef7
SHA1737c8a42008940eb4cffa02eb838500a8fdac90d
SHA256e05f132d8f8089aa9530c5988a9d1f4fb56dd279ffe1891b2364aebd54297137
SHA512190d07a7ba1826221c2256095ddcb5ca1db9542aaf5d99993d64c2484318a7f59a6e54ba4849dcf68539136e8acc9a7ce2c776bf6d849d010de149d8439c0392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe279baf21bf0fdc93f36e49d703b4d8
SHA14ddda127bebffa19cae83d9ba65e77a05096ddf8
SHA25615d64d502b93ece3dc75f46946c568c9e8b63d4e8ef42a9e34efd55f6bca7aa4
SHA5121736ace4d0829cd01dd1dc010ec82ce2fb2db00ea8f8ba2cf72b2616ae3418b0f576e026ef205f28e81c0cf362c7cdca238a40caad810e8ab447d84e2f1a4f6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54374703816f3074be21861b3b648fe55
SHA172fddf6330927d81fb7068483a59755b9befed7b
SHA2567089dfac96990bb48910ad1b47f7090277f60cf15ecf741c65fd99062efd838f
SHA512322cc035c55f75faffc5d1d0087963d98358f5435688220cbc0b7b20d482180c1be95142ec5b4540786780d965d8d53fa9aac5dc6a3969d0379d8e2c30cd974c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d03317f7b1f18262fe6ab978b0cdcbbc
SHA1e7fd1678c827c57a8f85466f0c8f6bde7d70945d
SHA256f2b53e20dce07a4e728509733ffec32e6245ab0267bc48ac412dcc5bbf91e885
SHA512734039b75e8dd9c345f5591cb691184d725c50211c4aee99f66b9a1aa3deacbe1c77a7a916dff50cbfd6fa8e4e8692bf1e873dfd4b1c37e34bd1bd9757996a8f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63